A recent supply chain attack has compromised over 100,000 websites through the popular Polyfill JavaScript library. The library is widely used to ensure compatibility with modern JavaScript features in older browsers. Different web applications and Content Management Systems (e.g. Magento), include code that introduces static script imports of JavaScript code sourced from cdn.polyfill.io.

Earlier this year, a Chinese company acquired the Polyfill domain. The attackers used the control of the domain to distribute malicious JavaScript code instead of legitimate libraries. This allows performing arbitrary malicious activity in the context of the victim's browser: redirecting users to phishing sites, stealing sensitive information, or even further propagating malware.

The attack is similar to stored Cross-Site Scripting (XSS) and does not require any actions from the victim other than visiting a web page. Successful attacks have already been recorded on other websites.

The Wallarm platform detects the compromised applications and the corresponding web pages with static imports of JavaScript code from the *polyfill.io domain and other malicious domains involved in this campaign: (kuurza[.]com, googie-anaiytics[.]com, bootcss[.]com, macoms[.]lanewcrbpc[.]com, polyfill[.]io, bootcdn[.]net, staticfile[.]net, unionadjs[.]com, xhsbpza[.]com).

Check the vulnerabilities page in the Wallarm console for the vulnerability “Malicious JavaScript injection via supply chain attack (polyfill.io)” as demonstrated on the figure below. If the vulnerability was found:

1. Consider removing the Polyfill library entirely from the application’s dependencies.

2. Ensure that there are no references to malicious domains in the source code: (kuurza[.]com, googie-anaiytics[.]com, bootcss[.]com, macoms[.]lanewcrbpc[.]com, polyfill[.]io, bootcdn[.]net, staticfile[.]net, unionadjs[.]com, xhsbpza[.]com).

3. If Polyfill functionality is needed, consider using trustworthy alternatives.

4. Investigate potential incidents of attacks on your application users.

If the vulnerability was not found, we still recommend analyzing the source code of all projects, especially those not protected with the Wallarm platform.