cross-posted from: https://programming.dev/post/16106778
Contrary to what is stated on the polyfill.io website, Cloudflare has never recommended the polyfill.io service or authorized their use of Cloudflare’s name on their website. We have asked them to remove the false statement, and they have, so far, ignored our requests. This is yet another warning sign that they cannot be trusted.
It’s always a danger when a malicious company purchases a famous open source project.
Like that israeli adware company that bought simple mobile tools
I donated to the Tibor guy and I feel betrayed for how he managed the situation
I feel for the guy. Had health issues and needed money fast. I kinda don’t blame him. Like I get its disappointing and I also won’t blame people being mad at him, but I’m more mad at the overall system of how things get funding
Whenever I see those “All the companies that use us” banner, I shrug.
If I was a scammer, why wouldn’t I include a dozen companies?
Nice. Unfortunately this won’t tackle the mountains of sites that use bundlers.
Direct linking via a specific CDN was the problem. This is solved by bundlers, not caused by it.
The polyfill.js is a popular open source library to support older browsers. 100K+ sites embed it using the cdn.polyfill.io domain. … However, in February this year, a Chinese company bought the domain and the Github account. Since then, this domain was caught injecting malware on mobile devices via any site that embeds cdn.polyfill.io.
I read the story and specifically the bit about the Github account. Isn’t this the Polyfill lib’s Github account? Because if that’s the case, how would a bundler solve the issue? The new owners could modify the original source, then the CICD jobs would happily publish that to registries and from there down into the bundles. Is it a different Github account they’re talking about?
Code pulled from GitHub or NPM can be audited and it behaves consistently after it has been copied. If the code has a high reputation and gets incorporated into bundles, the code in the bundles doesn’t change. If the project becomes malicious, only recently created bundles are affected. This code is pulled from polyfill.io every time somebody visits the page and recently polyfill.io has been hijacked to sometimes send malicious code instead. Websites that have been up for years can be affected by this.