Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Do not promote polyfill.io as the domain is shut down due to malicious reports #2799

Closed
amureki opened this issue Jun 27, 2024 · 0 comments
Closed

Do not promote polyfill.io as the domain is shut down due to malicious reports #2799

amureki opened this issue Jun 27, 2024 · 0 comments

Comments

@amureki
Copy link
Contributor

amureki commented Jun 27, 2024

Greetings, and thanks for a fantastic project!

Recent and concerning news led me to creating this issue:

I noticed in the README.md traces of polyfill.io (even though the project is not using polyfills and mentioned domain):

plyr/README.md

Lines 769 to 771 in 7c8f833

## Polyfills
Plyr uses ES6 which isn't supported in all browsers quite yet. This means some features will need to be polyfilled to be available otherwise you'll run into issues. We've elected to not burden the ~90% of users that do support these features with extra JS and instead leave polyfilling to you to work out based on your needs. The easiest method I've found is to use [polyfill.io](https://polyfill.io) which provides polyfills based on user agent. This is the method the demo uses.

The domain was taken down by Namecheap, but in any case it is worth removing the mention of it.

Best,
Rust
@amureki amureki changed the title Do not promote polyfill.io as the domain is shut down due to maliciousness reports Do not promote polyfill.io as the domain is shut down due to malicious reports Jun 27, 2024
@friday friday closed this as completed in 0fca5bf Jun 28, 2024
friday added a commit that referenced this issue Jun 28, 2024
@friday
Merge pull request #2800 from amureki/remove-polyfill-io-mentions
a148e2e 
Fix #2799 -- drop recommendation of polyfill.io
6TELOIV added a commit to 6TELOIV/website that referenced this issue Nov 25, 2024
@6TELOIV
Remove polyfill.io script
2b613bf 
Polyfill.io has been compromised and should not be used. https://www.bleepingcomputer.com/news/security/polyfillio-javascript-supply-chain-attack-impacts-over-100k-sites/
formatjs/formatjs#4363
sampotts/plyr#2799
remix-run/react-router#11733
@6TELOIV 6TELOIV mentioned this issue Nov 25, 2024
Merged
Haroenv pushed a commit to yarnpkg/website that referenced this issue Nov 25, 2024
@6TELOIV
Remove polyfill.io script (#1230)
f82b8a0 
Polyfill.io has been compromised and should not be used. https://www.bleepingcomputer.com/news/security/polyfillio-javascript-supply-chain-attack-impacts-over-100k-sites/
formatjs/formatjs#4363
sampotts/plyr#2799
remix-run/react-router#11733
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@amureki