🔒️ Fix polyfill supply chain attack vulnerability

[ebouchut]

This PR removes the polyfill JS import from LoopDocs due to the below security issue.

Over 100,000 sites have been impacted in a supply chain attack by the Polyfill.io service after a Chinese company acquired the domain and the script was modified to redirect users to malicious and scam sites.

Today, cybersecurity company Sansec warned that the polyfill.io domain and service was purchased earlier this year by a Chinese company named 'Funnull' and the script has been modified to introduce malicious code on websites in a supply chain attack.

"However, in February this year, a Chinese company bought the domain and the Github account. Since then, this domain was caught injecting malware on mobile devices via any site that embeds cdn.polyfill.io," explains Sansec.

When the polyfill.io was purchased, the project developer warned that he never owned the polyfill.io site and that all websites should remove it immediately. To reduce the risk of a potential supply chain attack, Cloudflare and Fastly set up their own mirrors of the Polyfill.io service so that websites could use a trusted service.

"No website today requires any of the polyfills in the http://polyfill.io library," tweeted the original Polyfills service project developer.
[...]
Read more

Source: BleepingComputer:

• Sansec: "Polyfill supply chain attack hits 100K+ sites":
  https://sansec.io/research/polyfill-supply-chain-attack

Additional Context

Note

The Polyfill JS library provides code that replicates missing or unsupported modern JavaScript features in older browsers, ensuring compatibility for applications using APIs like Promise, fetch, or Object.assign. It is commonly used in web projects targeting a wide range of browser versions to maintain functionality without requiring developers to manually write compatibility code. Typical use cases include supporting legacy browsers like Internet Explorer 11 or outdated Android WebViews and enabling modern features such as Intl (internationalization), IntersectionObserver, or ES6+ methods in older environments.

[ebouchut]

👍 LGTM