Polyfill.io Abuse Prompts Cloudflare to Auto-Rewrite Script Links

Polyfill.io, a widely used JavaScript library service, can no longer be trusted. Reports corroborated by Cloudflare’s own Page Shield client-side security system show the service was being used to inject malicious JavaScript into users’ browsers. Given the library’s popularity, this poses a real risk to the broader Internet.

In response, Cloudflare has released an automatic URL rewriting service that redirects any polyfill.io reference on proxied websites to its own mirror under cdnjs. This avoids breaking site functionality while mitigating the supply chain attack risk. Free plan users have the feature activated automatically; paid plans can enable it with a single click.

BLOG-2464 Embedded Image - 4sSrsS

A Pivot From Concern to Action

In February, polyfill.io was sold to Funnull, an unknown company with no industry track record. Concerns about a supply chain risk led Cloudflare to spin up its own mirror of the polyfill.io code under cdnjs. The worry — highlighted even by the original author — was that a malicious owner could inject code into the library and cause far-reaching security problems across hundreds of thousands of sites, or target specific websites.

That fear materialized on June 25, 2024, when the service was observed injecting code that, under certain circumstances, redirected users to other websites. Cloudflare has taken the exceptional step of rewriting on-the-fly any HTML references to polyfill.io in customer sites, pointing them instead to its safe mirror. While other threat feed providers have flagged the domain as malicious, Cloudflare has avoided outright blocking it to prevent widespread web outages, given estimates that nearly 4% of all websites use polyfill.io.

Evidence of Malicious Activity

Reports indicated the injected code would redirect users to betting sites by loading additional JavaScript from a set of domains considered Indicators of Compromise (IoCs), including a deliberately misspelled Google Analytics domain:

https://www.googie-anaiytics.com/analytics.js
https://www.googie-anaiytics.com/html/checkcachehw.js
https://www.googie-anaiytics.com/gtags.js
https://www.googie-anaiytics.com/keywords/vn-keyword.json
https://www.googie-anaiytics.com/webs-1.0.1.js
https://www.googie-anaiytics.com/analytics.js
https://www.googie-anaiytics.com/webs-1.0.2.js
https://www.googie-anaiytics.com/ga.js
https://www.googie-anaiytics.com/web-1.0.1.js
https://www.googie-anaiytics.com/web.js
https://www.googie-anaiytics.com/collect.js
https://kuurza.com/redirect?from=bitget

Page Shield, available on all paid plans, collects information about JavaScript files loaded by end users’ browsers. Scanning its database, Cloudflare found matches with the IoCs as far back as June 8, 2024, confirming active malicious activity associated with polyfill.io.

How the Rewriting Works

Performing HTML alterations on streaming responses requires speed. Cloudflare leverages ROFL (Response Overseer for FL), a Rust-based system that powers other HTML-altering products like Cloudflare Fonts, Email Obfuscation, and Rocket Loader. Rust’s memory safety and compiled performance allow ROFL to process millions of requests per second while minimizing added latency.

When the feature is enabled, Cloudflare parses all script tag source attributes in HTML responses. Any link to polyfill.io is rewritten to the cdnjs mirror, preserving the query string and mapping the correct version. The rewrite does not trigger if a Content Security Policy (CSP) header is present, ensuring policies are not violated and websites remain functional.

Why Free Users Get It by Default

Cloudflare decided to enable the rewrite by default for free plan customers, who often run simpler applications and lack resources to respond quickly to security issues. This protects a large portion of polyfill.io-dependent sites with minimal risk of breakage. Paid customers — who typically have more complex deployments and faster response times — can enable the virtual patch with one click from their dashboard. All customers can disable it anytime.

This is not the first time Cloudflare has taken such decisive action. In 2014, it enabled Shellshock protection for everyone, and in 2021, it rolled out protections against the log4j vulnerability across all plans.

What You Should Do

If you are a Cloudflare paid customer, head to your zone’s Security ⇒ Settings to enable the rewrite. Free customers are already covered. However, the best practice is to remove polyfill.io from your projects entirely.

Search your code repositories for polyfill.io references and replace them with Cloudflare’s mirror at cdnjs.cloudflare.com/polyfill/. The URLs serve identical content, so the change is non-breaking. This applies to all website owners, regardless of whether you use Cloudflare.

The underlying bundle links to use are:

This ensures your website no longer relies on polyfill.io. Cloudflare also notes it never recommended the service or authorized its use of Cloudflare’s name; requests to remove the false statement have been ignored, further signaling that the service cannot be trusted.