“The new Chinese owner of the popular Polyfill JS project injects malware into more than 100 thousand sites.”
A Chinese company bought the polyfill.io domain and its GitHub account in February. Over 100,000 sites, JSTOR, Intuit and the World Economic Forum among them, kept loading whatever script the new owner chose to serve. The payload skips admin users and hides from analytics tools, so the people in a position to catch it never see it. Google cut off ads for eCommerce sites using the script before most of them noticed they had a problem.