Connect cloud app - polyfill pop up

[rdcritchlow]

I have a deployed app on Connect Cloud and occasionally get a polyfill pop up requesting username and password - does the community know why this is happening
and if there is a fix for it? Thanks.

[Simon_Smart]

Does the app import javascript scripts? If you can share the source that would be helpful.

Have you seen articles like this about the domain? Polyfill.io Attack Infects Over 110,000 Websites - Spiceworks

[rdcritchlow]

@Simon_Smart

Does the app import javascript scripts?

Thanks - i did see those types of articles.

I didn't think the app was importing javascript scripts, but it does use R packages that'll bundle their own javascripts (e.g. DT, plotly, leaflet, shinyWidgets, bslib), it also renders html pages in iframes - could that be a source?

[Simon_Smart]

I'd be surprised if it was originating from current package versions as more people would be affected. Are your versions up to date?

If you can use bash, then worth seeing if this catches anything (search all your packages for polyfill.io):

grep -rln "polyfill.io" $(Rscript -e 'cat(.libPaths())')

This says you can try inspecting the network traffic too on the app, but you said it is erratic and you have to refresh to get the traffic:

https://www.reddit.com/r/sysadmin/comments/1ttjp1i/suspicious_login_popup_from_polyfillio_on/

[rdcritchlow]

This is really useful - thanks. I have inspected the traffic and identified it is linked to a .html which contains MathJax that I rendered from a .qmd. I'll check all packages are up to date, and re-render the html + deploy to check if that is a fix