Abandoned CDN Domain Re-registered, Posing Supply Chain Risk to Thousands of Sites

Abandoned CDN Domain Re-registered

In July 2025, a domain previously used by a content delivery network (CDN) was re-registered after its expiration. Despite the CDN being defunct for years, thousands of websites, code repositories, and documentation pages continue to contain hard-coded references to hostnames under this domain.

New Owner Controls Content Delivery

The new owner now holds wildcard DNS for the entire domain, meaning any hostname under it resolves to infrastructure they control. Currently, the apex domain serves an ad-heavy media downloader page. This situation grants the new owner control over the content loaded by thousands of pages that still reference the abandoned domain, without any notification to the affected parties.

Precedent: The polyfill.io Incident

This scenario is not unprecedented. In June 2024, the polyfill.io domain, a JavaScript shim embedded in over 110,000 sites, changed ownership. It subsequently began serving conditional redirects to mobile visitors. These sites were not hacked; they simply continued to use an outsourced script tag without re-evaluating its source.

Supply Chain Vulnerability

Both cases illustrate a supply chain problem where malicious code is not hosted on the organization's server but is delivered via third-party scripts. Traditional security tooling like static analysis and dependency scanning do not address this, as they focus on what an organization builds and ships, not on external scripts fetched by a visitor's browser.

Client-Side Attack Vector

Third-party scripts operate with the same privileges as first-party code, allowing them to read the DOM, form fields, cookies, and local storage, and make outbound requests. This enables client-side attacks, such as Magecart-type compromises, without requiring a server breach. The vulnerability arises when an approved script tag begins to behave differently due to a change in its source.