polyfill.io supply chain

[vostrik]

Should we discuss the situation around polyfill.io?

Subj:
https://www.sonatype.com/blog/polyfill.io-supply-chain-attack-hits-100000-websites-all-you-need-to-know

Background:
https://blog.cloudflare.com/polyfill-io-now-available-on-cdnjs-reduce-your-supply-chain-risk

Potential npm packages which inject this code in runtime:

1. https://github.com/search?q=polyfill.io+language%3ATypeScript+&type=code
2. https://github.com/search?q=polyfill.io+language%3AJavaScript+&type=code

What I personally think: maybe we should try to suspend from Node.js community side new owners at GitHub as potentially malicious distributor.
It looks like the new owners are deleting all issues related to the situation:

1. https://web.archive.org/web/20240229113710/https://github.com/polyfillpolyfill/polyfill-service/issues/2834
2. https://github.com/polyfillpolyfill/polyfill-service/issues/2834