[EKSolutions]

It looks like someone has compromised one of their subdomains for Polyfill

Update: Subdomain seems to be returning normal responses again now.

[Aachen]

You mean the IA included some JS polyfill from a subdomain and that's what's compromised / where the alert is coming from?

[mendym]

Yup.

https://news.ycombinator.com/item?id=41792651

[qnsc]

yes, "https://polyfill.archive.org/v3/polyfill.min.js?features=fet..." is the URL with the malicious code

[Shadow1337]

It looks like it is running the service that was part of the supply chain attacker earlier this year. https://github.com/polyfillpolyfill/polyfill-service/issues/...

[jsheard]

The service was fine, it was the "official" hosted instance of the service which was compromised. IA appears to be running their own instance.

[abracadaniel]

That was a DNS hack of polyfill.io though right? This looks like it was/is self hosted.

[__jonas]

Yeah I'm getting this exact response from the above URL now:

https://sourcegraph.com/github.com/polyfillpolyfill/polyfill...

Seems like they self hosted that service

[EKSolutions]

Correct. The source subdomain of the popup seems to be hxxps[:]//polyfill[.]archive[.]org

[jrochkind1]

That would perhaps explain how they managed to inject the JS alert popup, right?

[TZubiri]

Yeah, but the leak has been confirmed by HIBP, I found my address in there.

[jrochkind1]

DOH. I hadn't heard this.