384k sites pull code from sketchy code library recently bought by Chinese firm

More than 384,000 websites were found linking to a code library that was recently involved in a supply-chain attack after being acquired by a Chinese firm. The JavaScript code hosted on polyfill[.]io was altered to redirect users to adult and gambling sites. Industry responses included domain suspensions, content delivery networks replacing links, and ad blocks. Despite these actions, over 384,000 sites continued to link to the compromised domain, including mainstream companies like Hulu, Mercedes-Benz, and Warner Bros., as well as government entities. Researchers also discovered other domains associated with the Chinese firm engaging in potentially malicious activities. The incident highlights the risks of supply-chain attacks, where malware can spread to numerous users through a common source. The situation was contained after domain suspensions, but concerns remain about potential future exploits if the domain restrictions are lifted. Efforts to reach the Chinese firm for comment were unsuccessful.