What happened?
In late June 2024, researchers at Sansec dropped the finding that polyfill.io — a domain serving a humble JavaScript “polyfill” library embedded by hundreds of thousands of websites — had been sold, and its new owners rewrote the hosted script to inject malicious code: redirects to scam pages and phishing, mobile-only, triggered selectively so desktop QA never saw it. By June 27, when this post publishes, “100,000+ sites inherited a malicious script” was the headline, Cloudflare had stood up an auto-secure mirror, and the web was relitigating its third-party script addiction.
Quick Answer: polyfill.io’s new owner (Funnull) weaponized the domain in June 2024 — 385K+ embedded sites, 475M monthly visits — serving mobile/referer-conditional scam redirects that jammed security QA; remediation meant purging the tag (polyfills were no longer needed) or pinning self-hosted copies; arrests followed in 2025.
The sale chain read like a cautionary fable: a Chinese-registered buyer acquired the domain and GitHub org in February 2024; the code changed subtly from April; by June the S3-backed payload was serving conditional redirection to sports-betting and scam affiliates. Sansec’s telemetry, plus community OSS scans, sized the blast radius: hundreds of thousands of embeds — WordPress themes and plugins among them — and a total monthly footprint near half a billion visits. The nastiest detail was operational: the payload gated on mobile user-agents and referer conditions so standard desktop tests missed it entirely.
Anatomy of a supply-chain asset flip
The pattern had precedent — this was not the first time a genuinely valuable-but-neglected infrastructure asset was bought and weaponized, though the scale made it the century’s flagBearer so far. What made polyfill.io irresistible to a buyer: ubiquitous embeds, a trustworthy-seeming name, and an owner ready to sell without notifying dependents. The market lesson: any externally hosted “utility” script is one domain-transfer away from becoming an implant across its entire foreach of dependents, and the dependency graph has no notification mechanism when ownership changes hands.
| Date | Event |
|---|---|
| 2024-02 | Domain and GitHub organization acquired by new ownership after short public notice |
| 2024-04→ | Hosted script begins serving conditional malicious redirection (mobile plus specific referers) |
| 2024-06-25/26 | Sansec disclosure; Cloudflare auto-replaces polyfill.io requests with a safe mirror for its customers; Google delists malicious destinations |
| 2024-06-27 | Counts stabilize in the 100K–500K site range – depending on census method — this post publishes amid cleanup |
| 2024-06→07 | “polyfill hits back” round: DNSTXT-based retribution against Sansec; Namecheap seizes the domain; 2025 arrests of Taiwanese nationals linked to Funnull |
Why the polyfill was already obsolete
Aggravating irony: most embedders did not need the script anymore. The eponymous library back-filled ES5-era browser gaps; by 2024 every evergreen browser had native support for the relevant features, and the service’s own original author recommended everyone simply remove the tag years earlier. The lesson generalizes: dormant dependencies are silent liabilities without owners, they do not expire — they wait, embedded in themes and templates, until someone buys the upstream.
- Remove: if you embed polyfill.io today, delete the tag; it is dead weight at best, hostile at worst.
- Self-host and pin: any third-party script you must use belongs on your origin, SRI-hashed and version-locked, not fetched from a domain you do not control.
- CSP: default-src ‘self’-style policies with explicit allowlists turn “someone flipped the domain” from incident into non-event.
- Inventory: maintain a script-tag census of your properties (themes past and present); asset flips cannot be responded to in assets you did not know you ran.
FAQ
What did the malicious script actually do?
Served conditional redirects: mobile devices (and certain referer patterns) were bounced through an intermediary to scam and betting sites, likely earning affiliate revenue. No large-scale credential theft was required for the business model to work — traffic arbitrage paid fine. Later variants dallied with search-redirection and additional payloads, but redirect monetization was the core.
Were users of the CDN mirrors (jsDelivr, cdnjs) affected?
No — those served pinned copies of the open-source library code, not the polyfill.io domain’s rewritten payload. The compromise lived at the domain, not in the library source. Sites self-hosting or using mirrors with SRI were safe; sites hot-linking the service domain were the exposed class.
Who did it, and what happened to them?
Attribution converged on operators behind the Funnull CDN operation; Sansec tracked their infrastructure, the crew responded with petty DNS harassment against security researchers, and in 2025 authorities in Taiwan arrested Taiwanese nationals linked to Funnull in connection with the campaign — a rare supply-chain-to-handcuffs arc, even if the affiliate economics keep the model alive.
The bigger debate it ignited
Beyond cleanup, the hijack forced a structural question: how should the web treat widely-embedded, externally-hosted utility scripts? Interest sharpened around SRI adoption, “self-host everything you can” doctrine, and even proposals for ownership-change notifications in dependency chains. Meanwhile the incident entered marketing lore alongside the 2024 Edgeweight-style flips — proof that in the supply chain, the cheapest exploit is sometimes just buying the asset. Expect faster flipping going forward: the asset class now has a proven revenue model, and registrar-level intervention (Namecheap’s seizure here) became a precedent worth citing.
The mirror-war subplot
Cloudflare’s move deserves its own paragraph: it transparently stood up a clean, self-hosted replacement and began auto-serving it for sites requesting polyfill.io, converting an internet-wide cleanup into a plumbing fix for a large fraction of the web in days. Critics noted the precedent’s double edge – an infrastructure intermediary quietly rewriting third-party responses is exactly the capability defenders want here and fear everywhere else – and the debate matured into “intermediary responsibility” doctrine that resurfaced with every 2024-2025 supply-chain event. Meanwhile Funnull’s DNS-harassment retaliation against Sansec guaranteed the crew’s name stayed in every follow-up report, a self-inflicted reputational own goal.
Coda: check your pages today
For a timeline that usually deals in breaches and ransomware, polyfill.io is the entry most readers can personally verify: view-source any site you operate, search for polyfill.io, and if the tag exists — remove it. The campaign taught the web an uncomfortable inventory lesson at 475-million-visits scale: your page is your dependency graph, rendered; you own what it loads, whoever hosts it.
