News for hackers. Stuff that matters.
Re:Polyfill supply chain attack hits 100K+ sites by pcthrowaway on Tuesday June 25, 2024 @04:12PM (#40793046)
This supply chain attack had nothing to do with npm afaict.

The dependency in question seems to be (or claim to be) a lazy loader that determines browser support for various capabilities and selectively pulls in just the necessary polyfills; in theory this should make the frontend assets leaner.

But the CDN used for the polyfills was injecting malicious code.

Re:Polyfill supply chain attack hits 100K+ sites by bdcravens on Tuesday June 25, 2024 @04:27PM (#40793206)
yes, but the NPM packaging ecosystem leads to a reliance on externally-hosted dependencies for those who don't want to bundle
Re:Polyfill supply chain attack hits 100K+ sites by josephg on Tuesday June 25, 2024 @04:34PM (#40793270)
Sounds like a bad idea to me.

I would expect latency (network round trip time) to make this entire exercise worthless. Most polyfills are 1kb or less. Splitting polyfill code amongst a bunch of small subresources that are loaded from a 3rd party domain sounds like it would be a net loss to performance. Especially since your page won’t be interactive until those resources have downloaded.

Your page will almost certainly load faster if you just put those polyfills in your main js bundle. It’ll be simpler and more reliable too.

Re:Polyfill supply chain attack hits 100K+ sites by tehbeard on Wednesday June 26, 2024 @07:56AM (#40798916)
In practice when this wasn't a Chinese adware service, it proved to be faster to use the CDN.

You are not loading a "bunch" of polyfill script files, you selected what you needed in the URL via a query parameter, and the service took that plus user agent of the request to determine which were needed and returned a minified file of just the necessary polyfills.

As this request was to a separate domain it did not run into the head of line / max connections per domain issue of Http 1.1 which was still the more common protocol at the time this service came out.