On: Polyfill supply chain attack hits 100K+ sites

[johnmaguire]

In general, SRI (Subresource Integrity) should protect against this. It sounds like it wasn't possible in the Polyfill case as the returned JS was dynamic based on the browser requesting it.