Rogue Polyfill JavaScript CDN triggers suspicious login prompts on Toshiba, Muji websites

This resurgence of a known supply chain vulnerability underscores the extreme persistence of technical debt in modern web delivery. For streaming operators and tech giants, the incident demonstrates that even dormant or deactivated third-party dependencies can regain the ability to compromise client-side security if the underlying domain is reacquired or reactivated. This lapse highlights a failure in dependency auditing across disparate devices, from browsers to Smart TVs. Operators should watch for a rise in automated browser security policies that block unauthenticated third-party CDNs by default.

The polyfill.io crisis originally peaked in June 2024 when security researchers at Sansec discovered the domain was serving malicious JavaScript to over 100,000 websites. Per BleepingComputer in June 2024, the domain had been acquired by a Chinese entity named Funnull, which subsequently used the scripts to redirect mobile users to gambling and adult sites. The original creator of the Polyfill project, Andrew Betts, publicly urged developers to stop using the service immediately, noting that such CDNs represent a massive, unvetted trust vector in the web supply chain.

In response to the 2024 incident, major industry players took aggressive defensive measures. Per Cloudflare and Google in June 2024, both companies launched safe, automated mirrors of the Polyfill library to prevent websites from loading scripts from the compromised cdn.polyfill.io domain. Despite registrar Namecheap suspending the domain at that time, many organizations failed to fully scrub the legacy code from their production environments.

Recent reporting by security researcher Pasquale Pillitteri in June 2026 explains that the domain's registration transferred from Namecheap to GoDaddy in late May 2026. This transfer likely allowed the domain to begin responding to requests again, triggering the 401 authentication prompts seen on Japanese corporate sites and Samsung hardware. Security experts emphasize that modern browsers no longer require external polyfills for most features, making the continued presence of these scripts an unnecessary security risk.