polifill.io Malware?

[hhp94]

Description

Hi,

I've been using RStudio to render my Quarto QMD document into HTML. Recently, I noticed that my HTML file is opening slower than usual. Upon checking my browser's console, I discovered it is due to "connecting to polyfill.io."

Given the recent vulnerabilities and malware issues associated with this domain (as reported in this news article), I am concerned about potential exposure to this vulnerability. Can someone provide more information on this? I have no experience about cyber securities.

Thank you.

[mcanouil]

You need to upgrade your Quarto version.
As far as I know, >=1.4 no longer has this in the template coming from Pandoc.

• remove polyfill.io integration #10135

[mcanouil]

@hhp94 the usual way to deal with vulnerabilities is to upgrade the tool.

[hhp94]

Thank you so much. I had the Windows CLI installed. So I went to https://quarto.org/docs/get-started/ to download the new version of the CLI and confirmed that it no longer connects to polifill.io. Thank you for your answer

[mcanouil]

In case you had the RStudio embedded version. Upgraded RStudio also use a more up to date version of Quarto (but not necessarily the latest contrary to a manual install).