A dormant supply chain threat has roared back to life, catching several major Japanese corporations off guard and exposing the persistent risks of abandoned third-party dependencies. Technology giant Toshiba and retail powerhouse Muji have issued urgent warnings after malicious authentication screens began appearing on their websites, potentially harvesting user credentials through a compromised JavaScript service.
The incident traces back to the notorious polyfill.io domain compromise of 2024, but reveals a troubling pattern: organizations failing to fully remediate supply chain contamination, leaving digital time bombs ticking in their infrastructure.
The Polyfill Problem Resurfaces
The current wave of attacks stems from websites still carrying remnants of the polyfill.io Content Delivery Network (CDN) service, despite security experts urging complete removal two years ago. Polyfill provides JavaScript compatibility layers that allow modern websites to function on legacy browsers—a seemingly innocent utility that became a weapon when malicious actors acquired the expired domain.
What makes this incident particularly insidious is the attack vector. Rather than deploying traditional malware, the compromised domain now responds to requests with HTTP 401 authentication challenges. When browsers encounter these responses, they automatically generate login prompts that appear legitimate to unsuspecting users.
The beauty of this attack lies in its simplicity—no complex exploitation required, just social engineering through browser behavior manipulation.
Security researcher findings indicate the polyfill.io domain reactivated in late May, immediately beginning to serve these authentication requests to any website still referencing the service. Beyond Toshiba and Muji, reports suggest Samsung Smart TVs, Zojirushi appliances, and several publishing companies have also been affected.
Supply Chain Vulnerabilities Persist
This incident underscores a critical weakness in modern web development: the challenge of maintaining clean dependency hygiene over time. When the original polyfill.io compromise occurred in 2024, affecting over 100,000 websites, the cybersecurity community rallied with clear guidance to remove all references to the malicious CDN.
Yet here we are, two years later, with major corporations still harboring these toxic remnants in their web infrastructure. The problem isn't just technical—it's organizational. Development teams move on, documentation becomes outdated, and forgotten code snippets lurk in rarely-visited pages or legacy systems.
The original Polyfill creator, recognizing the domain acquisition threat, had already migrated the legitimate service to alternative domains. However, the persistence of old references demonstrates how supply chain contamination can remain dormant for extended periods before reactivating.
Current Threat Assessment
While neither Toshiba nor Muji have confirmed credential theft or unauthorized access, the potential for data harvesting remains significant. Users who encountered these prompts and entered their login information face elevated account compromise risks.
The attack's sophistication lies not in its technical complexity but in its psychological manipulation. Browser-generated authentication prompts carry inherent legitimacy in users' minds—they appear as standard browser security features rather than obvious phishing attempts.
Current evidence suggests the threat actors are testing the waters, potentially preparing for more aggressive campaigns. The fact that multiple high-profile targets remain vulnerable indicates a substantial attack surface for future exploitation.
What You Should Do
This incident serves as a stark reminder that supply chain security isn't a one-time fix but an ongoing discipline. The organizations affected aren't victims of sophisticated zero-day exploits—they're casualties of incomplete remediation and inadequate dependency management.
As the threat landscape evolves, the most dangerous attacks may not be the newest and most complex, but the oldest and most forgotten. In cybersecurity, yesterday's partially-addressed incident can easily become tomorrow's major breach.
