After the polyfill.io domain changed hands, the CDN began injecting malware into scripts served to sites embedding it, redirecting mobile users to malicious sites.
Affected an estimated 100k+ websites; a landmark 'CDN dependency' supply-chain incident.
A legitimate package's maintainer account or pipeline was taken over and a malicious version published.
Attacks like this are why dependency provenance matters. Scan your manifests against the Gold database, or add the free CI gate to block risky dependencies before they merge.