Polyfill.js attack

[sylvia-teacher]

Hello! Your excellent online project OpenIntroStat may somehow use the polyfill.js open-source library, which apparently is now a domain owned by a malicious company that injects code into websites or redirects them (https://blog.qualys.com/vulnerabilities-threat-research/2024/06/28/polyfill-io-supply-chain-attack) . Today (5/31/2026) I observed that links into the Intro to Modern Statistics (2e) book redirected to polyfill and asked for a login in my Firefox browser, both Firefox on desktop and Firefox on mobile. I did not observe the same problem on Edge (desktop) or on Startpage browser (mobile).

Hope this helps; please fix this so I can safely link my students to their reading! If the problem is specific to my computer of course disregard, and apologies.

[mine-cetinkaya-rundel]

Thank you for the report. Could you share an example of a link that redirects there?

[sylvia-teacher]

Yes! It happened whenever I link any page from the online textbook into my Canvas class, such as this link: https://openintro-ims.netlify.app/data-hello . I create the link to that page, click it, and it redirects to https://polyfill.io/v3/polyfill.min.js?features=es6 when I am using Firefox to click it. I can then click Cancel and it redirects correctly.

After playing with it for a bit, I realized that this is only true for those links that have -ims.netlify.app in the URL; perhaps that is my mistake and my bookmarks are to the wrong version of the site -- i do not have any such redirect with the https://openintrostat.github.io/ims/ versions of the site. I will just update my links to those if this was my error; dunno why my links were wrong if so! apologies.