Poisoned Pipeline / Incidents / AS8
Polyfill.io CDN takeover
The polyfill.io domain, embedded by hundreds of thousands of websites as a
JavaScript CDN, changed hands. The new operator served malicious script in
place of the expected polyfill, redirecting users and injecting extra
payloads. CISA and multiple CDNs issued emergency guidance to stop loading
assets from cdn.polyfill.io. This incident is a web-asset supply-chain
compromise, not a package-registry event, and was missing from the technique set until
T0205 was added.
Mapped techniques
- T0205 Compromise third-party CDN or hosted web asset
- T0121 Compromised legitimate artifact
- T0180 Compromise services / servers
- T0159 Malicious artifact execution
- T0207 Skip or forge artifact integrity verification
- T0201 Customers compromised
supply-chain polyfill.io
Control of the hostname was enough; sites that hotlinked the CDN
began executing attacker JavaScript with no application deploy.
The familiar script URL kept its name and consumers while the bytes
behind it changed.
Taking over the CDN service itself, rather than a consumer site,
multiplied blast radius.
post-supply-chain Sites embedding polyfill.io
Browsers executed the substituted script in the origin of every
embedding site.
Sites hotlinked the CDN without Subresource Integrity, so the bytes
behind the trusted URL could change without a check failing.
End users of those sites were the actual victims; site owners were
the unwitting distribution channel.
Framework gaps noted
- Subresource Integrity (SRI) and allow-listed CDNs are mitigations that were not previously tied to a CDN-compromise technique.