On: Polyfill supply chain attack hits 100K+ sites

[creshal]

Or just ship local copies of your dependencies. It's not that hard.

[commandlinefan → creshal]

... and all of _their_ dependencies. And read through them all to make sure that the local copy that you shipped didn't actually include a deliberately obfuscated exfiltration routine.