After the polyfill.io domain changed hands, the CDN began injecting malware into scripts served to sites embedding it, redirecting mobile users to malicious sites.
Affected an estimated 100k+ websites; a landmark 'CDN dependency' supply-chain incident.
A legitimate package's maintainer account or pipeline was taken over and a malicious version published.
Attacks like this are why dependency provenance matters. Scan your manifests against the Gold database; a free CI gate that blocks risky dependencies before they merge is coming soon.