Forum Discussion
polyfill.io Supply Chain Risk in Self-Authored Content
We recently received the following notification from HealthStream. Does anyone know if this would apply to content created using an Articulate product?
| HLC: HEALTHSTREAM LEARNING CENTER |
Customer Security Notice: polyfill.io Supply Chain Risk in Self-Authored ContentSummaryHealthStream recently became aware of a third-party supply chain risk involving the polyfill.io JavaScript service. The risk affects self-authored content: courses, assessments, documents, and HTML or SCORM packages that your organization may have created and uploaded into the HealthStream Authoring Center or other applications. Any such content that loads a script from polyfill.io can serve attacker-controlled code to the browsers of your learners. We are asking every customer that authors its own content to review that content and remove all references to polyfill.io. Background The polyfill.js library is a widely used open-source project that helps older browsers support functionality found in newer browsers, and thousands of sites embed it from the polyfill.io domain. In 2024, a third-party bad actor purchased the domain along with the project's GitHub account and modified the library so that malicious code could be inserted into websites that embedded scripts from it. Now, any script adopted from that original domain could immediately download malicious code from the new owner's site. The reported outcomes include redirecting users to scam sites, theft of sensitive data, and the potential for code execution in the visitor's browser. This typically operates as a pop-up requesting a user to enter their login credentials. Because modern browsers no longer require the functionality that polyfill provided, security best practices suggest that websites remove any reference to polyfill.io. Why This Matters for Self-Authored Content Content your organization authors is content your organization controls. As such, HealthStream has limited insight into the underlying components of self-authored content. Course packages, embedded HTML, custom pages, and authoring-tool exports frequently carry script tags that were copied from a template or generated automatically years ago and may not have been revisited. A polyfill.io reference inside one of those packages may continue to execute every time a learner opens the content regardless of the software environment. The exposure is not limited to material built by hand. Output from commercial authoring tools, vendor-supplied modules, and legacy pages migrated from an earlier system can all carry the same reference. Until a package has been checked, we recommend treating it as in-scope. It’s important that you and your organization remain vigilant and not click any links or enter credentials into a pop-up that may result from this script. Suggested Next Steps
The domains and script references below have been identified as compromised. Treat a match inside your content as an item requiring removal, and a match in your web traffic logs as an item requiring investigation by your security team.
|
1 Reply
Storyline and Rise publish output bundles its own scripts locally rather than pulling from third-party CDNs, so I would not expect a vanilla export to ever have referenced polyfill.io. The only current risk I see likely could be with older content where anything a person added by hand, like JavaScript triggers, web objects, embed blocks, or an HTML package someone built years ago. Old templates I guess could be another area of risk. You can easily check your SCORM files, unzip and search the folders for the domain names in the HealthStream notice.
