Polyfill.io and the ruling that exposes credentials: the urgent lesson about the open source supply chain

An open source supply chain failure again became visible this week when Japanese companies like Toshiba and MUJI alerted their visitors to suspicious start-up windows that could request credentials. The apparent cause was not a direct hack to the affected sites, but a third: the CDN service that served compatibility scripts, polyphil.io, reresponded and caused browsers to show an HTTP authentication dialog. Toshiba published an official communication asking users to cancel these notices and, in case of data entry, change their passwords ( Toshiba communiqué).

To understand mechanics: many websites include small scripts hosted in external CDNs to fill in functions that old browsers do not implement - the so-called "polyfill" -. When the polyphil.io domain expired in 2024 it was claimed and, according to previous investigations, malicious scripts were delivered to thousands of pages. Although the official service was relaunched in another domain by the project, residual references remained on many websites; now, the reactivation of the original domain is giving way to responses that browsers interpret as authentication orders, showing the dialog box that many users confused with a legitimate form of the site.

The difference between a web form and the browser authentication dialog is crucial: the pop-up that requests user / password in the top bar or in a native window does not always belong to the web and often indicates an HTTP 401 header in the response. This behavior can be used to deceive the user or, at worst, to capture credentials if the server behind the malicious domain is scheduled to register them.

The practical consequences for now seem limited to inconvenience and confusion: there is no public evidence that there has been a massive theft of credentials in relation to the incidents reported this week. However, the repetition of the problem again exposes two structural risks: the dependence of resources on third parties without direct control and the difficulty of purging old code from large sites that operate with distributed templates or caches.

If you saw one of these emerging windows, act with caution: do not enter information in unexpected dialogues, cancel the prompt and access the service manually from your home page. If you came to enter credentials, change the password immediately and activate the multifactor authentication in the affected account. Also check the recent activity of the account for unusual access and, if you use the same password in other services, change it there too.

For technical equipment and website managers the episode should sound like an alarm: look for references to polyfill [.] io throughout the inventory of pages (including static files, old templates and cached pages), and remove them or replace them with a local copy or a controlled source. The original repository of the polyfill service and its source code are publicly available; using a community-maintained version or hosting the polyfill internally reduces exposure to expired domains ( Polyfill-service repository).

Beyond removing dependence, it is recommended to implement preventive measures such as Subresource Integrity (SRI) when linking external scripts, restrictive Content-Security-Policy policies, periodic third-party audits and domain reference scans to detect obsolete resources. A response strategy should also be maintained by proactively communicating to users and customers when suspicious behaviour is detected on the company's website.

Independent researchers have already recorded similar cases on other devices and brands, and have documented how domain activation resulted in 401 requests that trigger the authentication box ( technical analysis of Pasquale Pillitteri). The operational message is clear: Hygiene in the management of dependencies and the elimination of orphan code are critical safety tasks; they are not only optimizations, but vector defenses that reappear when a domain changes hands.

If you are a user, check passwords, activate MFA and keep your browser updated. If you manage a site, locate and clean any reference to polyphil.io, evaluate the impact of the CDN on your attack surface and consider policies that minimize the execution of third party code without verification. The incident is a practical lesson about how large-scale threats can be born from seemingly harmless elements in the web ecosystem.