Examining the Polyfill Attack from Akamai's Point of View

...

MSC-2024-5191

A malicious Polyfill reference has been identified in this package. The issue is located in the file "package\examples\browser\prettyprintingwithmathjax.html". To address this security concern, we recommend taking one of three actions: upgrade the package version to 10.5.3, where the reference wa...

MSC-2024-3875

A malicious Polyfill reference has been identified in this package. The issue is located in the file "Xlwings\html\xlwings-alert.html". To address this security concern, we recommend taking one of three actions: upgrade the package version to 0.31.7, where the reference was removed, or either...

MSC-2024-4004

A malicious Polyfill reference has been identified in this package. The issue is located in the file "Xlwings\html\xlwings-alert.html". To address this security concern, we recommend taking one of two actions: either remove the affected file completely or replace the suspicious reference with a...

Polyfill Library Injected with Malware Impacting 100,000 Websites

A trusted JavaScript library, Polyfill.io, became a malware delivery system. Security experts exposed the attack and the potential consequences for website visitors. Learn how this supply chain attack highlights the importance of web development security and what steps developers can take to...

Over 110,000 Websites Affected by Hijacked Polyfill Supply Chain Attack

Google has taken steps to block ads for e-commerce sites that use the Polyfill.io service after a Chinese company acquired the domain and modified the JavaScript library "polyfill.js" to redirect users to malicious and scam sites. "Protecting our users is our top priority. We detected a security...

pdoc embeds link to malicious CDN if math mode is enabled

Impact Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. Users who produce documentation with math mode should update immediately. All other users are unaffected. Patches This issue has been fixed...

GHSA-5VGJ-GGM4-FG62 pdoc embeds link to malicious CDN if math mode is enabled

Impact Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. Users who produce documentation with math mode should update immediately. All other users are unaffected. Patches This issue has been fixed...

Malicious code in npm_package_dependencies_promise_polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 812a88e649d4ae3319f178ec2ba4be3b92660d1887021d1525e1c46baa5618f6 The OpenSSF Package Analysis project identified 'npmpackagedependenciespromisepolyfill' @ 8.3.0 npm as malicious. It is considered malicious...

MAL-2024-921 Malicious code in npm_package_dependencies_promise_polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 812a88e649d4ae3319f178ec2ba4be3b92660d1887021d1525e1c46baa5618f6 The OpenSSF Package Analysis project identified 'npmpackagedependenciespromisepolyfill' @ 8.3.0 npm as malicious. It is considered malicious...

SUSE CVE-2023-45133

Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that re...

Debian DSA-5528-1 : node-babel7 - security update

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5528 advisory. - Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to compile...

Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code

Impact Using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the path.evaluateor path.evaluateTruthy internal Babel methods. Known affected plugins are: - @babel/plugin-transform-runtime -...

UBUNTU-CVE-2023-45133

Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that re...

Code injection

Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that re...

CVE-2023-45133

Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that re...

CVE-2023-45133

CVE-2023-45133 affects Babel’s traversal layer. The issue allows arbitrary code execution during compilation when compiling code crafted by an attacker via plugins that rely on path.evaluate() or path.evaluateTruthy(). Affected in: @babel/traverse prior to 7.23.2 and 8.0.0-alpha.4, and all versio...

CVE-2023-45133 Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code

Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that re...

RUSTSEC-2023-0089 atomic-polyfill is unmaintained

The author has archived the GitHub repository and mentions deprecation in project's README. Possible alternatives portable-atomic...

a4 (>=0.0.1, <=0.0.4), a4-core (>=0.0.3, <=0.0.4) +809 more potentially affected by unknown CVE via atomic-polyfill (1.0.3)

atomic-polyfill CARGO version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on atomic-polyfill and may be impacted: - a4 =0.0.1, =0.0.3, =0.23.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.4.1, =0.1.0, =0.7.7, =0.9.0, =0.12.0 and more Source cves: unknown...