[ad_1]
Context: https://sansec.io/research/polyfill-supply-chain-attack
I have a couple WordPress sites and am wondering if WordPress/plug-ins use Polyfill. I didn’t originally build either of these sites, but I am now maintaining them. A number of .php and .js files contain the text “polyfill” (although some might just be comments). I figure I only have to worry if Polyfill is being provided via CDN.
Has anyone here tried to mitigate this? I know they seized the domain, but I want to be sure I cover my bases.
[ad_2]
If you’re behind CloudFlare, they are intercepting calls to the CDN and serving a cleaned version of polyfill.