Affected Systems
Toshiba and Muji public websites, potentially other sites using the compromised third-party polyfill library. Scope of affected sites and specific polyfill service not yet confirmed.
Exploitation Status
Active exploitation confirmed. Malicious login prompts actively harvesting credentials on production websites. Attack vector is a compromised third-party JavaScript polyfill library.
Business Impact
Customer credentials at risk of theft on affected brand websites. Supply chain compromise affects multiple organizations simultaneously. Incident may erode customer trust and trigger breach notification requirements. Organizations using the same polyfill service face immediate credential harvesting risk. No CVE assigned yet, limiting automated detection.
Urgency
🔴 Immediate
Recommended Actions
- Audit all web properties for third-party JavaScript libraries, especially polyfill services, and review Content Security Policy (CSP) headers
- Block or remove references to the compromised polyfill domain in web application code and CDN configurations until the supply chain is verified clean
- Monitor web application firewall (WAF) and proxy logs for unexpected login prompt injections or credential POST requests to unfamiliar domains
- Force password resets for users who accessed affected sites during the compromise window and monitor for account takeover attempts
- Implement Subresource Integrity (SRI) hashes for all third-party JavaScript to prevent tampering in future supply chain attacks