{"id":56498,"date":"2024-07-01T16:29:33","date_gmt":"2024-07-01T16:29:33","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/polyfill-io-claims-reveal-new-cracks-in-supply-chain-but-how-deep-do-they-go\/"},"modified":"2024-07-01T16:29:33","modified_gmt":"2024-07-01T16:29:33","slug":"polyfill-io-claims-reveal-new-cracks-in-supply-chain-but-how-deep-do-they-go","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/polyfill-io-claims-reveal-new-cracks-in-supply-chain-but-how-deep-do-they-go\/","title":{"rendered":"Polyfill.io claims reveal new cracks in supply chain, but how deep do they go?"},"content":{"rendered":"

Opinion<\/span> Libraries. Hushed temples to the civilizing power of knowledge, or launchpads of global destruction? Yep, another word tech has borrowed and debased. Code libraries are essential for adding just the right standard tested functionality to a project. They’re also a natural home for supply chain attacks that materialize malware in the heart of the enterprise like shock troops of Klingons arriving by transporter beam.<\/p>\n

Last week saw a beaut. Polyfill.io, which serves 100,000-plus sites with JavaScript enhancements for older browsers, suddenly stood accused of poisoning its functions with malware<\/a> and thus attacking all of those sites’ users. It wasn’t even believed to be the standard supply chain hack, where the bad guys get into an unsuspecting middleware peddler and plant the pathogens. The claimed chain was that polyfill.io had been bought earlier this year and the new owners were themselves responsible. The call’s gone out to stop using polyfill.io immediately, with content delivery network Cloudflare redirecting calls to the site to sanitized proxies.<\/p>\n

Polyfill.io’s first reaction was to accuse the media and Cloudflare of slander. Perhaps a better position to take would have been to profess innocence, say you’re taking the situation seriously, and that you’re working closely with Cloudflare to urgently understand the matter. Angry accusations of media conspiracy may be very 2020s, but they put you in questionable company. In any case, the very concept of supply chain attacks by the owners of a supplier is a special case that deserves inspection, one that will need its own rules of engagement to control. It’s just that, right now, those rules are hard to discern.<\/p>\n