Polyfill supply chain attack hits 100K+ sites

Re:Polyfill supply chain attack hits 100K+ sites by ttyprintk on Tuesday June 25, 2024 @03:59PM (#40792907)

Would an unwisely-configured site template or generator explain the scale here?

Or, a malicious site template or generator purposefully sprinkling potential backdoors for later?

[ Parent | on HN ]

Re:Polyfill supply chain attack hits 100K+ sites by alephnerd on Tuesday June 25, 2024 @04:20PM (#40793130)

But wouldn't some sort of SCA/SAST/DAST catch that?

Like if I'm importing a site template, ideally I'd be verifying either it's source or it's source code as well.

(Not being facetious btw - genuinely curious)

[ Parent | on HN ]

Re:Polyfill supply chain attack hits 100K+ sites by ttyprintk on Thursday June 27, 2024 @06:54PM (#40816060)

I was hoping ongoing coverage would answer that; it sounds like a perfect example. I heard that the tampered code redirects traffic to a sports betting site.

[ Parent | on HN ]