Is My Site Secure

CDN · disclosed 25 June 2024

polyfill.io CDN takeover

polyfill.io was a popular service that sites loaded with a script tag to add modern JavaScript features to older browsers. In February 2024 the domain and its GitHub account were bought by Funnull, a company little was known about. By June 2024 the CDN was serving injected code that redirected some mobile visitors to scam and sports-betting sites, while hiding from site admins and analytics tools. Every site that loaded a script from cdn.polyfill.io was exposed, with no change to the site's own code.

  • Detectable by a website scanYes
  • Last reviewed23 October 2026

Timeline

  1. Funnull acquires the polyfill.io domain and the project's GitHub account (exact day not given in the sources).
  2. Cloudflare launches a polyfill mirror on cdnjs, warning that sites linking to polyfill.io now depend on Funnull.
  3. Earliest 'first seen' timestamp for a script matching the published indicators, in Cloudflare's Page Shield data.
  4. Sansec publishes its finding that cdn.polyfill.io is injecting malware that redirects mobile users. Google starts blocking ads for e-commerce sites that use polyfill.io.
  5. Cloudflare begins automatically rewriting polyfill.io script links to its cdnjs mirror (on by default for free-plan sites).
  6. Namecheap suspends the polyfill.io domain, which removes the immediate threat.

Affected packages

PackageAffected versions
cdn.polyfill.ioAll scripts served from the domain after the February 2024 ownership change. Malicious responses were confirmed in June 2024. The payload was generated per request and only fired for some visitors.
cdn.polyfill.comCounted by Censys alongside cdn.polyfill.io as a polyfill endpoint still embedded on websites.

Sansec: more than 100,000 sites embedded cdn.polyfill.io, including JSTOR, Intuit and the World Economic Forum. Censys: 384,773 hosts still referenced cdn.polyfill.io or cdn.polyfill.com on 2024-07-02, about 237,700 of them on Hetzner (AS24940). Cloudflare cited W3Techs data putting usage at nearly 4% of all websites.

What to do

  1. Remove every reference to polyfill.io and polyfill.com from templates, tag managers and CMS plugins, including preconnect and dns-prefetch hints.
  2. Check whether you still need a polyfill at all. Modern browsers rarely do. If you do, self-host it or use a trusted mirror such as https://cdnjs.cloudflare.com/polyfill/.
  3. Search your pages and logs for the Sansec indicators (www.googie-anaiytics.com, kuurza.com) to see whether visitors were redirected.
  4. Add a Content Security Policy that allows only the script hosts you trust, and monitor which third-party scripts your pages load.
  5. If your site sits behind Cloudflare, note that its automatic rewrite only hides the problem. Fix the source code anyway.

Sources

We update this page as new information is published. Package versions are also checked live against OSV.dev during every audit, so newly flagged versions are caught even before this page changes.