# New options for Polyfill.io users **URL:** \ **Category:** General\ **Created:** [February 28, 2024, 7:55pm UTC](https://community.fastly.com/t/new-options-for-polyfill-io-users/2540 "2024-02-28T19:55:07Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![triblondon](https://sea1.discourse-cdn.com/flex019/user_avatar/community.fastly.com/triblondon/32/29_2.png) [@triblondon](https://community.fastly.com/u/triblondon)\ **Post date:** [February 28, 2024, 7:55pm UTC](https://community.fastly.com/t/new-options-for-polyfill-io-users/2540/1 "2024-02-28T19:55:07Z")
Polyfill is a popular tool for enhancing browser capabilities. Many users access it by linking to the `polyfill.io` service, which has recently changed ownership to a new party. In order to ensure that everyone can maintain reliable and trusted access to Polyfill features, we have identified a few alternatives: - First, Fastly is offering `polyfill-fastly.net` and `polyfill-fastly.io` as a free, drop-in replacement for `polyfill.io` in your code; this is a [Tier 2 open source project](https://www.fastly.com/documentation/developers/community/open-source/#understanding-topics-and-support-levels) available now. - Second, Fastly’s fork of the [open source code](https://github.com/fastly/polyfill-service) can be used to **self-host** the service to maintain full control over the code delivered to users. - And finally, there’s a very easy option of **removing it entirely** , as most modern browsers prioritize cross-compatibility by default and you may well not need a shim to perform these functions. Moving to one of these new options can help ensure the security, reliability and trustworthiness of your site. Polyfill’s code remains under the same open license as ever, and Fastly customers that need any help with this transition can reach out to our support team for help as always. ---
**Author:** ![eligrey](https://sea1.discourse-cdn.com/flex019/user_avatar/community.fastly.com/eligrey/32/578_2.png) [@eligrey](https://community.fastly.com/u/eligrey)\ **Post date:** [June 30, 2024, 6:57pm UTC](https://community.fastly.com/t/new-options-for-polyfill-io-users/2540/2 "2024-06-30T18:57:14Z")
When did Fastly become aware of the supply chain attack conducted by Funnull? ---
**Author:** ![aspires](https://sea1.discourse-cdn.com/flex019/user_avatar/community.fastly.com/aspires/32/464_2.png) [@aspires](https://community.fastly.com/u/aspires)\ **Post date:** [July 2, 2024, 3:09pm UTC](https://community.fastly.com/t/new-options-for-polyfill-io-users/2540/3 "2024-07-02T15:09:47Z")
@eligrey – We found out when everyone else did with the publishing of the article by Sansec ([Polyfill supply chain attack hits 100K+ sites](https://sansec.io/research/polyfill-supply-chain-attack)). When we advised people to be aware of the sale, that was out of an abundance of caution just in case something like this did happen. ---
**Author:** ![shinpei3](https://sea1.discourse-cdn.com/flex019/user_avatar/community.fastly.com/shinpei3/32/589_2.png) [@shinpei3](https://community.fastly.com/u/shinpei3)\ **Post date:** [July 11, 2024, 2:05am UTC](https://community.fastly.com/t/new-options-for-polyfill-io-users/2540/5 "2024-07-11T02:05:31Z")
Can fastly NGWAF prevent this vulnerability ? If it can but some conditions required, let me know the conditions. ---
**Author:** ![aspires](https://sea1.discourse-cdn.com/flex019/user_avatar/community.fastly.com/aspires/32/464_2.png) [@aspires](https://community.fastly.com/u/aspires)\ **Post date:** [July 11, 2024, 6:56pm UTC](https://community.fastly.com/t/new-options-for-polyfill-io-users/2540/6 "2024-07-11T18:56:57Z")
Hi @shinpei3, this isn’t something that our NGWAF product is designed to detect. However, using Fastly Compute, a user could scan their HTML response bodies for references to `polyfill.io` and rewrite those to `polyfill-fastly.io`. ---
**Author:** ![kevin.fleming](https://sea1.discourse-cdn.com/flex019/user_avatar/community.fastly.com/kevin.fleming/32/244_2.png) [@kevin.fleming](https://community.fastly.com/u/kevin.fleming)\ **Post date:** [July 11, 2024, 7:40pm UTC](https://community.fastly.com/t/new-options-for-polyfill-io-users/2540/7 "2024-07-11T19:40:39Z")
Indeed, this vulnerability is in the _response_, not the _request_, so it’s not something that a WAF is designed to address. ---
**Author:** ![shinpei3](https://sea1.discourse-cdn.com/flex019/user_avatar/community.fastly.com/shinpei3/32/589_2.png) [@shinpei3](https://community.fastly.com/u/shinpei3)\ **Post date:** [July 11, 2024, 11:50pm UTC](https://community.fastly.com/t/new-options-for-polyfill-io-users/2540/8 "2024-07-11T23:50:04Z")
Understand. Thank you.