Polyfill supply chain attack hits 100K+ sites
Polyfill supply chain attack hits 100K+ sites
The new Chinese owner of the popular Polyfill JS project injects malware into more than 100 thousand sites.
For anyone interested - I’d you are using umatrix to block shit you can punch these lines into a new text file and import as blocklist, then commit it with the tiny arrow that points left toward the permanent list to save it permanently:
* www[.]googie-anaiytics[.]com * block
* kuurza[.]com * block
* cdn[.]polyfill[.]io * block
* polyfill[.]io * block
* bootcss[.]com * block
* bootcdn[.]net * block
* staticfile[.]org * block
* polyfill[.]com * block
* staticfile[.]net * block
* unionadjs[.]com * block
* xhsbpza[.]com * block
* union[.]macoms[.]la * block
* newcrbpc[.]com * block
Remove the square brackets before saving the file - these are here to prevent hyperlinks and misclicks.
Edit: this is not a bulleted list, every line must start with an asterisk, just in case your instance doesn’t update edits made to comments quickly.
Edit2: added new IOCs
Edit3: MOAR IOCS FOR THE HOARDE
The first domain should be googie-anaiytics, the L in analytics was replaced with an i
Good catch! Missed that one
Not many things require a polyfill these days. My guess is a lot of older sites are affected.
Intuit uses pollyfill… and a lot of people use that service.
Cloudflare and fastly wouldn’t be setting up mirrors if it weren’t still being used, I can guarantee that.
Opensource devs need to get paid a living wage 😩 This stuff keeps happening and somehow, I can't completely blame the devs. Thousands of sites use the product and barely anybody donates. It's not sustainable.
This has almost nothing to do with what you’re talking about.
A Chinese company bought the domain and the service in February and are attacking people in highly specific conditions. (Mobile devices at specific times)
This is an attack. Not negligence, not an uh oh oopsie woopsie fucky wucky. Attack.
