polyfill.io Supply Chain Risk in Self-Authored Content

DShaw​ is right, I scanned five published Storyline 360 SCORM packages spanning v3.20 through v3.98 (roughly 2018 to 2025, so both before and after the 2024 polyfill incident) 812 files total and there were zero references to polyfill.io or any of the eleven other domains in HealthStream's list.

No external script or stylesheet loads. No <script src="https://...">, no <link href="https://..."> anywhere in the published output.

That being said, there is still a possible risk with

- Web Objects pointing at a URL. These load live external content in an iframe and the content isn't in your package at all, so unzipping and searching won't show it.

- Execute JavaScript triggers, anything hand-added, especially copied from a blog post or template.

- Rise embed blocks and custom HTML blocks.

FYI: The polyfill.io domain is now a casino site so it is very unlikely that any lingering URLs will actually load anything into your course. That being said, still remove it because broken links can break your page, and modern browsers don't need the polyfill anyway. So if you do find a link it's just a cleanup and not an active incident.