polyfill.io Supply Chain Risk in Self-Authored Content

Storyline and Rise publish output bundles its own scripts locally rather than pulling from third-party CDNs, so I would not expect a vanilla export to ever have referenced polyfill.io. The only current risk I see likely could be with older content where anything a person added by hand, like JavaScript triggers, web objects, embed blocks, or an HTML package someone built years ago. Old templates I guess could be another area of risk. You can easily check your SCORM files, unzip and search the folders for the domain names in the HealthStream notice.