Episode 435 - polyfill.io - open source is too big to fix

Open Source Security Podcast

Josh and Kurt talk about the latest polyfill.io mess. Apparently someone took over a very popular project and started to serve malware. First XZ, now this. What does it mean for open source? We don't have any answers, and it's hard to even talk about this problem because it's so big. The thing is though, even if we can't fix open source, it's here to stay.

Show Notes

• Polyfill supply chain attack hits 100K+ sites
• OpenSSF Scorecard