polyfill.io
Polyfill service. Sold to Funnull in 2024 and used to deliver malware: treat as compromised; remove and self-host.
SECURITY: Active supply-chain risk since Feb 2024. Cloudflare and Fastly run safe mirrors.
This profile contains catalog information about the service and its recorded ownership. Request evidence from an individual StackPatrol scan is reported separately.
Detection signatures
StackPatrol attributes requests to this service when a hostname or URL matches one of these reviewed catalog patterns. A report shows the actual request separately.
polyfill.iopolyfill.comOwnership and transfer review
The catalog classifies polyfill.io as China-owned, with China recorded as its country. The catalog records Funnull as the corporate parent. Ownership is a review signal, not evidence of the contracting entity, processing location or an international data transfer.
If your website loads polyfill.io scripts or sends requests to this service, review the contracting legal entity, its role, actual processing locations and sub-processors. If the observed use involves a GDPR Chapter V transfer, document the mechanism and any supplementary measures that apply to that specific processing.
Does your website contact polyfill.io?
Run a free front-page scan to see the requests StackPatrol can observe and how they map to the catalog.