InformAction Forums

I registered to post that until yesterday, I had permanently allowed polyfill.io probably because it was used on a media site such as www[.]telegraph.co.uk. However, it appears that it is now a danger https://www.scmagazine.com/news/polyfil ... 0-websites. If there are any others out there like me, they might want to move it to disallowed.

Wow, thanks for the heads up.

Some more information:
https://www.bleepingcomputer.com/news/s ... 00k-sites/
https://sansec.io/research/polyfill-supply-chain-attack

it is now a danger

Correct.

PaleMoon: Polyfill supply chain attack: New Chinese domain owner infects dependent sites


And you can take it further (much further, actually) as it is not only "polyfill"... but anything that is "3rd party"...


And you can take it further, because of such nonsense by vast majorities of websites, that is why tools like NoScript exist .