polyfill.io detection

http/miscellaneous/polyfill-io.yaml

@@ -0,0 +1,30 @@
+id: polyfill-io-detect
+
+info:
+  name: Polyfill.io Detection
+  author: kazet
+  severity: low
+  description: The polyfill.io CDN was suspected to serve malware.
+  reference:
+    - https://sansec.io/research/polyfill-supply-chain-attack
+    - https://web.archive.org/web/20240229113710/https://github.com/polyfillpolyfill/polyfill-service/issues/2834
+    - https://blog.cloudflare.com/polyfill-io-now-available-on-cdnjs-reduce-your-supply-chain-risk
+  metadata:
+    verified: true
+    max-request: 1
+  tags: cdn,polyfill.io
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+
+    redirects: true
+    max-redirects: 1
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "<script[^>]* src=['\"]https?://([a-zA-Z0-9-]*.)?polyfill.io[/'\"]"