Polyfill supply chain attack - bootcdn and staticfile
If the authors do not update the script, could you add a warning to the users that "The listed script contains malware CDNs. Do you still want to install" when the install button is clicked?
I think this would not be just a one time case. China's network is so dirty.
This will happen again and again in the future.
I don't think it's the case that every script on those CDNs is infected; it sounds like just polyfill was affected.
If that's not true, then I think the thing to do would be remove the scripts that use those CDNs entirely from Greasy Fork until the authors update them.
I think this would not be just a one time case. China's network is so dirty.
This will happen again and again in the future.
Unfortunately, many "Western" CDNs are either blocked or very slow in China, so it's not as simple as getting everyone to use the ones we're familiar with.
https://sansec.io/research/polyfill-supply-chain-attack
Of the domains listed as affected, Greasy Fork's allowed CDN list included bootcdn.net, bootcss.com, staticfile.net, and staticfile.org. These have now been removed as allowed CDNs. If you are using these CDNs in your scripts, I suggest you modify your script immediately.