Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
In 2024, attackers showed how a single trusted JavaScript dependency could put many unrelated websites at risk. The Polyfill.io incident is the clearest mass-exposure example: Sansec estimated that more than 100,000 sites embedded the affected service. That is not proof that every site delivered malicious code or suffered data theft. It is evidence of a broader problem: websites often depend on code that runs in visitors’ browsers but is controlled by outside services.
Other campaigns targeted online stores through compromised ecommerce platforms and abused Google Tag Manager to deliver skimmers. Together, they showed why a clean web server does not guarantee a safe page. The browser has become part of the attack surface.
What a client-side attack does
“Client-side” means code that runs in a visitor’s browser, rather than only on the website’s server. A malicious script can inspect or change the page, watch form fields and checkout events, insert a fake login or payment form, redirect a visitor, or send information to an attacker-controlled destination.
Free tools Windows power users keep installed
One-click scans. No signup required.
That code may run only for particular devices, locations, referrers, times, or users. A site can therefore look normal to its administrators while selected visitors receive a malicious payload. The origin server may not be defaced, and a server-side malware scan or inbound-focused firewall may not see the browser behavior at all.
#1 Best Overall
Online skimming can enter a site directly or arrive through a third-party application such as advertising, chat, or customer-rating software, as the PCI Security Standards Council’s online-skimming guidance explains. The risk is not limited to payment cards: browser-side code can also target credentials, personal information, advertising, or user trust.
Why the shared JavaScript layer matters
Modern websites routinely load analytics, advertising pixels, tag managers, chat widgets, libraries, ecommerce extensions, fraud tools, and payment components. One script can also load another, creating a chain of dependencies that is not obvious from a quick look at a page’s source.
Cloudflare reported that its typical enterprise customer used an average of 47 third-party scripts and connected to about 50 third-party destinations. In a separate research sample, Verizon counted 51,968 scripts on payment pages, with 17,002 accessing personally identifiable information. These figures show how much code can operate around sensitive pages; they do not mean those scripts were malicious. Cloudflare also noted that Magecart-style attacks accounted for 18% of retail-sector data breaches in Verizon’s 2024 DBIR. See Cloudflare’s 2024 application-security report and the 2024 Verizon Payment Security Report.
The important distinction is between exposure and confirmed impact: a site can depend on a service that is compromised without every visitor receiving the payload, and payload delivery does not by itself prove data was accessed or stolen. A useful way to describe an incident is: dependency, exposure, payload delivered, code executed, sensitive data accessed, data exfiltrated, confirmed victim impact.
Polyfill.io: a remote dependency with a wide blast radius
Polyfill.io supplied JavaScript intended to provide browser compatibility features. In early 2024, ownership of the domain and associated project assets changed. On June 25, Sansec reported that the service was serving malicious JavaScript to sites that embedded it, estimating that more than 100,000 websites used the service. Its investigation described selective targeting and evasive behavior, including device, referrer, and timing checks and redirects through a lookalike analytics domain. Sansec’s investigation and the CNCF TAG Security incident record document the episode.
A dependency could be as simple as:
<script src="https://cdn.polyfill.io/v3/polyfill.min.js"></script>The site owner controlled the HTML, but each visitor’s browser fetched the script from a remote service. Because the response could vary by request, the dependency delegated runtime control to an outside party. Reviewing the URL alone—or loading the page once from one device—could not establish what every visitor received.
The public reporting documented malicious code execution and selective redirection; it does not establish that all of the estimated 100,000-plus dependent sites lost payment data, or even that every site’s visitors received the same payload. The incident’s significance is the scale of potential browser-side exposure, not a claim of uniform harm.
Cloudflare introduced automatic rewriting of Polyfill.io links for relevant sites proxied through its service. That was a provider-specific mitigation, not a universal fix. Cloudflare’s explanation describes the scope of that response.
If your site may still reference Polyfill.io
- Search source code, templates, CMS fields, tag-manager containers, and generated HTML for
polyfill.io,cdn.polyfill.io,bootcdn.net,bootcss.com,staticfile.net, andstaticfile.org. - Remove the dependency where it is no longer needed. If compatibility code is still required, use a maintained alternative or bundle the necessary code locally after reviewing it.
- Purge caches and redeploy. Check rendered pages and browser network logs for remaining requests; a domain block alone may not remove old HTML, cached pages, or tag-manager rules.
- Review changes made during the relevant exposure period. If the site handled sensitive data, assess whether payloads could have reached visitors and follow your incident-response and notification obligations.
CosmicSting: when a server compromise becomes a browser-side skimmer
Not every client-side attack begins with a third-party provider. CosmicSting, associated with CVE-2024-34102, involved vulnerabilities affecting Adobe Commerce and Magento environments. Sansec reported that seven groups had compromised 4,275 online stores in related campaigns. These are researched stores, not a claim of a complete global victim count. See Sansec’s campaign reporting.
The chain illustrates how the two sides of website security connect:
Origin vulnerability
↓
CMS or ecommerce compromise
↓
Injected JavaScript or modified store content
↓
Visitor’s browser executes the skimmer
↓
Payment or customer data may be exfiltratedPatching the platform closes the known entry point, but does not remove a backdoor, injected code, altered database content, or unauthorized administrator account already left behind. Recovery should include reviewing CMS blocks, database content, checkout templates, users and privileges, and suspicious files or scheduled tasks. Without removing persistence, an apparently cleaned store may be compromised again.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsGoogle Tag Manager abuse: familiar loader, attacker-controlled payload
Recorded Future documented Magecart campaigns that used attacker-controlled Google Tag Manager containers to inject code into ecommerce pages. Its research identified 569 affected ecommerce domains, of which 87 were still infected at the time of reporting. These counts describe that research, not every compromise involving tag managers. See Recorded Future’s analysis.
In this pattern, the page may contain a familiar GTM bootstrap script while the malicious behavior is controlled through a container. That makes the attack easy to miss in a static file review. A marketing user may have permission to publish container changes, and a server scan may find no modified JavaScript file. Blocking GTM outright can also break analytics, consent systems, advertising, and conversion tracking, so the answer is controlled use—not assuming the platform itself was universally compromised.
For GTM and similar tag managers, keep an inventory of container IDs and authorized accounts; require review before publication; alert on new users, containers, and custom HTML tags; and avoid unnecessary marketing tags on checkout pages. Monitor what scripts do in the browser, not just which loader appears in the source.
How skimmers hide and evade routine checks
Attackers have used base64 and layered encoding, inline event handlers, malformed attributes, dynamic payload retrieval, and code disguised as analytics or advertising integrations. They may target mobile visitors, particular referrers, selected times, or users who do not appear to be administrators. Some delay execution or avoid obvious developer and analysis environments.
Recommended Free Tools
Rank #4
Akamai has documented loaders hidden behind legitimate-looking domains and code made to resemble familiar services such as Google Analytics or Facebook Pixel. Another technique used an image-tag onerror handler to run obfuscated JavaScript. That illustrates why a script search cannot be limited to clean-looking <script> tags. Read Akamai’s analysis of loaders behind legitimate domains and its report on skimmers using 404-page and image-tag techniques.
Why conventional defenses can miss browser attacks
- Server malware scanners can find altered files on the origin but may not inspect code delivered by a remote vendor or tag manager.
- Web application firewalls are often tuned for malicious requests to the site. Browser-executed code delivered in an otherwise legitimate response—or from a third party—can fall outside that view. Akamai notes that many Magecart attacks evade popular web-security methods such as WAFs.
- File-integrity monitoring helps with local changes but will not necessarily detect a vendor’s changing remote response.
- Static review and vulnerability scans may not execute JavaScript, follow dynamically loaded code, or reproduce selective targeting.
- One browser test from one device and location may not trigger a conditional payload.
- Allowlisting a domain says that a source is permitted; it does not prove that its code is safe or unchanged.
No single control covers every delivery path. Server hygiene, vendor governance, and browser-side observation need to work together.
A practical site audit
Start by mapping scripts on the pages where the consequences are highest: checkout and payment, login, account, and password reset. A quick code search can find known references:
grep -RniE 'polyfill.io|bootcdn.net|bootcss.com|staticfile.(net|org)' .To list script URLs in downloaded HTML:
grep -oiE '<script[^>]+src="[^"]+"' page.htmlOr inspect a live response:
curl -Ls https://example.com | grep -oiE '<script[^>]+src="[^"]+"'These are triage checks, not proof that a site is clean. They may miss dynamically added scripts, different HTML variants, obfuscated loaders, and behavior that appears only under certain conditions.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- In Chrome or another browser, open Developer Tools, choose Network, filter to
JS, and reload the page. Record script URLs and destinations, distinguishing first-party resources from third-party services. - Repeat on checkout, login, account, and password-reset flows. Test an ordinary and private session and, where relevant, mobile emulation. A difference can be a clue, but a lack of difference is not assurance.
- Review tag-manager containers, user access, recent changes, and custom HTML tags. Check whether each script has a documented owner and business purpose.
- Compare the current inventory with an approved baseline. Investigate new scripts, destinations, form access, unexpected event listeners, or outbound connections.
- If you find suspicious activity, preserve relevant logs and evidence, remove the delivery mechanism, purge caches, rotate exposed credentials where warranted, and involve your incident-response and payment partners when sensitive data may be affected.
Choosing controls that fit the dependency
Remove unnecessary code first
Removing obsolete libraries and unused marketing tags eliminates trust relationships rather than trying to monitor them forever. Test for regressions, especially if the code supported older browsers or a checkout feature. The reduction is often simpler and more durable than adding another security product.
Self-host stable dependencies where practical
Bundling a reviewed, stable library into your release can reduce runtime reliance on a remote domain. It does not make the code inherently safe: your team must track updates, patch it, and include it in dependency review. Self-hosting shifts responsibility; it does not erase it.
Use version pinning and SRI for suitable static files
Subresource Integrity (SRI) lets a browser verify that a fetched static resource matches a known hash:
<script
src="https://cdn.example.com/library-1.2.3.min.js"
integrity="sha384-REPLACE_WITH_REAL_HASH"
crossorigin="anonymous"></script>Replace the placeholder with a real hash and test the integration. SRI is useful for static, versioned assets, but a poor fit for services that generate different code by user agent, dynamically change content, or rely on tag-manager behavior. A fixed hash cannot readily authorize a deliberately variable response. SRI is not a general fix for Magecart or a compromised origin.
Roll out CSP carefully
A Content Security Policy can restrict script sources and report unexpected loads. Begin with an inventory and a Content-Security-Policy-Report-Only policy, review violations, remove dependencies that are not needed, then narrow allowed sources and enforce gradually. Test checkout, login, consent, analytics, and accessibility flows. A restrictive policy can break inline code, payment widgets, and scripts loaded dynamically by approved vendors; a broad allowlist can provide little protection.
Protect payment pages as a special case
Minimize scripts on payment pages and justify each one that remains. PCI DSS 4.0 requirements 6.4.3 and 11.6.1 make payment-page script authorization, integrity, and change detection important for merchants. The practical work is to know what executes, why it is there, and how unauthorized changes will be detected. Requirements and applicability depend on the merchant’s environment; this is security guidance, not legal or compliance advice. The Akamai overview of the Polyfill incident and PCI context and the Verizon report provide further context.
Monitor browser behavior, not just files
Static scanners can help inventory scripts and detect known indicators. Runtime monitoring can reveal unexpected form-field access, new destinations, or behavior that appears only on checkout. For larger or regulated environments, client-side protection products may centralize this visibility; choose based on actual coverage, operating model, and integration needs, and do not treat a monitoring service as a substitute for patching or script reduction.
The right way to read the “millions exposed” claim
For Polyfill.io, the strongest directly supported figure in the reporting cited here is Sansec’s estimate of more than 100,000 sites embedding the service—not millions of confirmed victims. CosmicSting reporting counted thousands of compromised stores, while the GTM research documented hundreds of affected domains. None of these figures proves that every visitor was targeted or that every site lost data.
“Millions exposed” is better understood as a warning about shared dependencies and potential blast radius than as a verified count of compromised sites. When many websites rely on the same browser-side services, an attacker may not need to break into each site individually. The security question for every owner is therefore not only whether the server is patched, but also what code the page asks a visitor’s browser to trust.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
