If you're still using polyfill.io you probably want to replace/remove it IMMEDIATELY. The domain has been sold and the new owners are injecting #malware (1).

If you absolutely have to use externally hosted #JavaScript and #CSS, it's a good idea to secure it with #SubresourceIntegrity (2). It's supported by most old browsers you're probably polyfilling for.

(1) https://polykill.io/
(2) https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

#polyfillio #polyfillioattack #supplychainattack

Our first #OpenSource release since our company was legally constituted. Not a big deal, but sort of a milestone :D.

A package to improve the security of your Astro site against #XSS attacks:
https://www.npmjs.com/package/@kindspells/astro-sri-csp

#Astrobuild #WithAstro #ContentSecurityPolicy #SubresourceIntegrity #WebSecurity

I've written a new blog post for #Mozilla's MDN.

https://developer.mozilla.org/en-US/blog/securing-cdn-using-sri-why-how/

All about #SubResourceIntegrity and why it is so important for securing your sites and its visitors.

Please share and provide feedback 🙂

Finally found the time to open a discussion on the Snowpack forums about the lack of subresource integrity (SRI) in Skypack: https://github.com/snowpackjs/snowpack/discussions/2569

(Background: my post from the end of last year titled Skypack: backdoor as a Service? https://ar.al/2020/12/30/skypack-backdoor-as-a-service/)

#skypack #snowpack #SubresourceIntegrity #SRI #security #privacy

If you specify subresource integrity in a script tag and then import that script also from a separate tag later on, and the source fails the integrity check, on

1. Firefox (Gecko): script doesn’t execute
2. Ungoogled Chromium (Chromium): script doesn’t execute
3. Epiphany (WebKit): script tag is blocked but script executes via the import

Not sure if Safari does the same but that’s not good.

#SubresourceIntegrity #security