search

theme-particlex / hexo-theme-particlex

A concise Hexo theme, based on Particle.
MIT License
410 stars 56 forks source link

Polyfill 相关服务可能不再安全 #116

Closed zkz098 closed 1 month ago

zkz098 commented 3 months ago

根据 https://github.com/polyfillpolyfill/polyfill-service/issues/2873 ，polyfill services 很可能参与了供应链攻击并分发了恶意代码 目前尚不清楚阿里源是反代还是源服务器，因而不能确定此主题内的 polyfill 是否安全 建议替换为 cloudflare cdnjs 的 polyfill 或删除相关内容

zkz098 commented 3 months ago

相关安全机构警告攻击进一步扩展，警告列表如下：

bootcdn.net
bootcss.com
staticfile.net
staticfile.org
unionadjs.com
xhsbpza.com
union.macoms.la
newcrbpc.com

参考：https://www.bleepingcomputer.com/news/security/polyfillio-bootcdn-bootcss-staticfile-attack-traced-to-1-operator/