1y ago

The new Chinese owner of the popular Polyfill JS project injects malware into more than 100 thousand sites

Polyfill supply chain attack hits 100K+ sites

The polyfill.js is a popular open source library to support older browsers. 100K+ sites embed it using the cdn.polyfill.io domain. Notable users are JSTOR, Intuit and World Economic Forum. However, in February this year, a Chinese company bought the domain and the Github account. Since then, this domain was caught injecting malware on mobile devices via any site that embeds cdn.polyfill.io. Any complaints were quickly removed (archive here) from the Github repository.

55 comments

nah. over 100k sites ignored dependency risks, even after the original owners warned them this exact thing would happen.
the real story is 100k sites not being run appropriately.
- I'm stealing this phrase
- One place I worked at recently was still using Node version 8. Running npm install would give me a mini heart attack... Like 400+ critical vulnerabilities, it was several thousand vulnerabilities all around.
  
  After the first 100, the other 300 kinda don't matter.
  
  If you're on RHEL 8+, you can install the latest version of node with dnf.
  dnf install nodejs will likely install node 8 :(. Use dnf module install nodejs:20 to install the latest version.
- the real story is 100k sites not being run appropriately.
  Same as it ever was. Same as it ever was. Same as it ever was.
  
  Yeah this is just capitalistic business in general. Don’t do anything proactive if it might reduce the bottom line in the short term. Blame others and beg for help when you weren’t proactive. Succeed singularly, fail collectively
  
  This isn't holding up, time isn't after us.
- 100k sites ignored dependency risks
  JS: typing systems are boring, warnings are boring, security is boring.
  
  Sure, the package managers of other languages are super safe
- I don't think we have to choose. "Maintain your websites so you don't get taken advantage of" and "Here's an example of a major-world-power-affiliated group exploting that thing you didn't do" are both pretty important stories.
  
  I mean, both are true? It's not a manipulative headline in my opinion.
  
  The malware thing still deserves a headline. They just argue it's stupid so many even have to use the library to begin with.
  
  Probably at your local asian gay bar.
This is why ublock origin is an essential security tool.
- This one is already in the default uBlock filters - Badware risks
  I also strongly suggest adding https://big.oisd.nl/ as a filter list. It's a large and well maintained domain blocklist (sourced from combining lots of other blocklists) that usually adds lots of these sorts of domains quickly and has very few false positives.
  If you want to take it even further, check out the Pro list and Thread Intelligence Feeds list here https://github.com/hagezi/dns-blocklists
  These can all be added to a pihole too if you use one.
  
  cdn.polyfill.io^ ? By now it was probably already added to the default lista tho...
  (I dont really understant these things tho, so correct me if I'm wrong)
My favourite part is that the developers that currently own it said:
Someone has maliciously defamed us. We have no supply chain risks because all content is statically cached
https://github.com/polyfillpolyfill/polyfill-service/issues/2890#issuecomment-2191461961
Completely missing the point that they are the supply chain risk, and the fact that malicious code was already detected in their system (to the point where Google started blocking ads for sites that loaded polyfill .io scripts.
We don't even know who they are - the repo is owned by an anonymous account called "polyfillpolyfill", and that comment comes from another anonymous account "polyfillcust".
- Pollyfilladmin
  
  Pollyfillpassword
- I'm not into JS stuff, but when I read that google is blocking ads, shit must be flowing in gargantuan amounts...
Reposting my comment from Github:
A good reminder to be extremely careful loading scripts from a third-party CDN unless you trust the owner 100% (and even then, ownership can change over time, as shown here). You're essentially giving the maintainer of that CDN full control of your site. Ideally, never do it, as it's just begging for a supply chain attack. If you need polyfills for older browsers, host the JS yourself. :)
If you really must load scripts from a third-party, use subresource integrity so that the browser refuses to load it if the hash changes. A broken site is better than a hacked one.
And on the value of dynamic polyfills (which is what this service provides):
Often it's sufficient to just have two variants of your JS bundles, for example "very old browsers" (all the polyfills required by the oldest browser versions your product supports) and "somewhat new browsers" (just polyfills required for browsers released in the last year or so), which you can do with browserslist and caniuse-lite data.
- Yeah I used to be guilty of this. Although in slight defense of myself I never used to use random sites like that I always used to pull everything from Google CDN since I can't see that changing hands.
  They may very well shut it down without warning, but they're probably not going to sell it to anyone.
  
  Yeah, it really depends on how much you trust the vendor.
  Google? Say what you want about the company, but they'll never intentionally serve malware.
  Random company with no track record where we don't even know who is maintaining the code? Much less trustworthy. The polyfill . io repo is currently owned by a Github user called "polyfillpolyfill" with no identifying information.
  Third-party CDNs make less sense these days though. A lot of hosting services have a CDN of some sort. Most sites have some sort of build process, and you usually bundle all your JS and CSS (both your code and third-party code, often as separate bundles) as part of that.
- Regular code review for security should be SOP
  
  You'd be surprised how much code people blindly reuse without even looking at it, especially in JavaScript. A bunch of it is from projects owned by random individuals. The JS standard library is ridiculously small, so nearly all JS apps import third-party code of some sort. One JS framework can pull in hundreds of third-party modules.
  It's much less of an issue with languages like C# and even PHP, where the first-party libraries are often sufficient for building a small or mid-sized app.
Man, the Chinese are becoming a new major nuisancec on internet.
Whichever editor let them post "100 thousand" should be spanked one 100 times with the severed hand of whatever asshole wrote it in the first place.
- spanked one 100 times
  One 100 times or 1 time, but 100 times?
  
  100x one 100 thousand times
  
  Yes
  
  Or one,100? 1,hundred? 1'100? Eleventy 100?
- 1 hundred times!
- 1000 hundred?
Wumao trolls incoming in 3..2...
- They must earn their 50 cents ...
  
  Pretty well paid then
that's not very nice to call javascript malware. i know it's bad but still.
That GitHub "archive here" link leads to a page where it hasn't been archived... (or was the archive removed??).
- Looks like someone tried to archive an archived page. You can see https://web.archive.org/... is listed twice in the url. I just trimmed off the first one then it works: https://web.archive.org/web/20240229113710/https://github.com/polyfillpolyfill/polyfill-service/issues/2834
- Sorry, it's corrected now (and thanks@DocMcStuffin)
Again?
This is probably connected to China cloning the entire GitHub website to their own servers.
- I'd be surprised if it's directly linked
  
  Being linked is how the malware works
  🥁 ba dum tish 🥁

55 comments