Contrib.social

polyfill.io library is no longer considered safe to use

Open on Drupal.org →
Created on 24 June 2024, 4 days ago
Updated 26 June 2024, 2 days ago

Problem/Motivation

The polyfill.io library has been sold to a Chinese company named Funnull that is not considered trustworthy. We believe this poses a grave security threat and the library is now considered unsafe.

https://twitter.com/triblondon/status/1761852117579427975

There is also evidence https://github.com/polyfillpolyfill/polyfill-service/issues/2873#issueco... that polyfill.io is used to serve malicious code.

Proposed resolution

There are some mentions in the project code comments to polyfill.io which could be replaced with a safe option from Fastly or Cloudflare.

https://community.fastly.com/t/new-options-for-polyfill-io-users/2540
https://blog.cloudflare.com/polyfill-io-now-available-on-cdnjs-reduce-yo...

📌 Task
Status

RTBC

Version

1.0

Component

Code

Created by

🇫🇮Finland HeikkiY Oulu

Live updates comments and jobs are added and updated live.
  • Security

    It is used for security vulnerabilities which do not need a security advisory. For example, security issues in projects which do not have security advisory coverage, or forward-porting a change already disclosed in a security advisory. See Drupal’s security advisory policy for details. Be careful publicly disclosing security vulnerabilities! Use the “Report a security vulnerability” link in the project page’s sidebar. See how to report a security issue for details.

Sign in to follow issues

Merge Requests

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.69.0 2024