The malware in the JavaScript library Polyfill.io.

There was news of malware in the JavaScript library Polyfill.io.
Polyfill.js is an open source library to support older web browsers, and it seems that municipalities and others running on older PCs may need to deal with it.

Fortunately, Polyfill.io was not used for anything I was involved with.

The malware was apparently introduced because a Chinese company bought the cdn.polyfill.io domain and a GitHub account, and then injected malware into mobile devices via a site that embeds this library. Scary.

I was reminded that I should gather information about IT as appropriate and look at security websites, especially for projects that are delivered privately, as it is difficult to realise that you are using them.

Resource from security company Sansec.

Translated with DeepL.com (free version)

Sansec

Polyfill supply chain attack hits 100K+ sites The new Chinese owner of the popular Polyfill JS project injects malware into more than 100 thousand sites.