Polyfill.io has been sold to a weird Chinese company and should no longer be recommended

[renchap]

Which package?

Documentation

Describe the bug

Polyfill.io was owned by the Financial Times web team, then moved under community management, and the last maintainer sold the project to a weird Chinese CDN company, and they moved it away from Fastly (the CDN / Edge compute platform running the OSS code for the service) and started to mess with the returned files.

From polyfill.io original creator: https://twitter.com/triblondon/status/1761852117579427975

Issue on their repo: https://github.com/polyfillpolyfill/polyfill-service/issues/2834

The domain polyfill.io is now a CNAME to polyfill.io.bsclink.cn, there has been no communication about this, or how the service is now ran (it previously depended on Fastly's edge compute platform, which is not available on this chinese cloud).

Fastly, who were not involved in this, but provided the service for free as part of their Fast Forward program, informed us that https://polyfill-fastly.io/ is an alternative domain they setup to help people move away from Polyfill.io, but this is probably not a long-term solution.

To Reproduce

Codesandbox URL

https://formatjs.io/docs/polyfills/intl-locale/

Reproducible Steps/Repo

Steps to reproduce the behavior:

1. See that polyfill.io is a recommended way to install the Polyfill

Expected behavior

The docs do not recommend loading polyfills from a no-longer trusted and transparent source

[SukkaW]

polyfill.io was acquired by a China-based CDN company "Funnull", see the announcement from the polyfill.io domain owner's Twitter and https://github.com/polyfillpolyfill/polyfill-service/issues/2834. Despite Funnull's claims of operating in the United States, the predominance of Simplified Chinese on its website suggests otherwise, and it turns out that "Funnull" is notorious for providing service for the betting and pornography industries.

The original creator of the polyfill.io has voiced his concern on Twitter. And since the acquisition, numerous issues have emerged (polyfillpolyfill/polyfill-service#2835, polyfillpolyfill/polyfill-service#2838, AlistGo/alist#6100), rendering the polyfill.io service extremely unstable. Since then, Fastly (Announcement) and Cloudflare (Announcement) has hosted their own instances of polyfill.io service.

[dir]

https://www.bleepingcomputer.com/news/security/polyfillio-javascript-supply-chain-attack-impacts-over-100k-sites/

This issue was ahead of it's time. Good call out.

[fproulx-boostsecurity]

Damn, indeed you had the eyes on the ball, long ago