---
title: "Why some websites show “polyfill.io requires a username and password,”
and what to do: do not enter any information"
url: https://roboin.io/article/en/2026/06/02/why-some-sites-show-polyfill-io-dialog/
description: Some websites now show a suspicious dialog asking users to enter a
username and password for polyfill.io. Do not enter a username or password if
this screen appears. Contact the website operator.
publishedDate: 2026-06-01T17:03:42.605Z
modifiedDate: 2026-06-01T17:03:42.605Z
thumbnail: https://roboin.io/api/media/file/polyfill-io-basic-auth-dialog.png
thumbnailAlt: polyfill.ioの認証画面が表示されているようすのスクリーンショット
thumbnailCaption: N/A
---
# Why some websites show “polyfill.io requires a username and password,” and what to do: do not enter any information
Some websites now show a suspicious dialog asking users to enter a username and password for polyfill.io. Do not enter a username or password if this screen appears. Contact the website operator.
## Do not enter anything if you see “polyfill.io requires a username and password”
Some websites now show dialogs like the following when you open them. The exact wording differs by browser.
- https://polyfill[.]io requires a username and password.
- Sign in https://polyfill[.]io
- Authentication is required at https://polyfill[.]io
- https://polyfill[.]io is requesting your username and password.
- This site is asking you to sign in. Warning: Your login information will be shared with polyfill.io. This sharing may extend beyond the website you are visiting.
*Example of a dialog shown on a website*
This kind of polyfill.io dialog is not a legitimate login screen prepared by the website, so **do not enter personal information, passwords, or any similar data**.
At the moment, users only see the dialog, but the domain could serve malicious code in the future. You should avoid accessing the website until the operator fixes the issue, and I urge you to contact the website operator.
These dialogs are HTTP authentication prompts shown by the browser, often called Basic authentication prompts.
Some older websites still use Basic authentication, but most modern websites use their own login screens instead.
The polyfill.io domain now appearing on some websites played a role in a major supply chain attack, a cyberattack, in 2024. Sites that have not removed polyfill.io now show dialogs like this one.
In the cases I checked, websites for Mitsui Shopping Park facilities and the official Autobacs online store showed this dialog in Japan.
The [website for the voice synthesis software VoiSona also appears to have shown the dialog](https://x.com/VoiSonaOfficial/status/2061122003038580753).
All of those websites have since fixed the issue, but many other websites have shown the dialog as well, and some have not fixed it yet.
## The cause is polyfill.io, which attackers used in a past supply chain attack
This dialog appears because the website you opened loads polyfill.io as an external script.
The exact code may vary, but if a website’s HTML still contains code like the following, the user’s browser accesses polyfill.io when the page opens.
```html
```
polyfill.io provided “polyfills,” which let older browsers use modern features. In 2024, a Chinese company acquired the service, and attackers turned it into malware and used it in a large-scale supply chain attack.
[Polyfill.ioが中国企業に売却 背景と対応策は？](https://roboin.io/article/2024/02/26/polyfill-io-sells-to-chinese-company-what-you-need-to-know/)
On June 25, 2024, the new China-linked owner of polyfill.io changed the source code and injected malware into mobile devices around the world through websites that loaded polyfill.io.
Attackers built the malware to evade detection, and reports say it redirected some affected users to scam websites.
According to [a report by CDN provider Akamai](https://www.akamai.com/ja/blog/security/polyfill-supply-chain-attack-what-to-know), more than 100,000 websites that loaded polyfill.io faced exposure to the supply chain attack at the time in 2024.
According to [Cloudflare, another CDN provider](https://blog.cloudflare.com/automatically-replacing-polyfill-io-links-with-cloudflares-mirror-for-a-safer-internet/), the attack began on June 8, 2024, and ended after Cloudflare and Namecheap intervened and disabled the domain on June 27 of that year.
However, when I checked, the domain had moved from Namecheap to GoDaddy on May 21, 2026, while retaining its original registration date, which suggests that polyfill.io may have come back online.
*Registration information for the polyfill.io domain. The registration information changed on May 21, 2026, and GoDaddy appears as the registrar*
The [Wayback Machine archive](https://web.archive.org/web/20260000000000*/http://polyfill.io/) shows that the polyfill.io website had come back online from at least May 23 to May 30. The polyfill.io domain, which should have been disabled, may have returned to its previous owner.
The domain owner information for polyfill.io remains private. Strictly speaking, we do not know whether the domain returned to the attacker behind the supply chain attack, passed to another malicious actor, or ended up with a “well-intentioned” third party.
## What can general users do? What if you entered your password?
If the polyfill.io login screen appears, do not enter a password or personal information, and stop using the page.
You should also contact the website operator and avoid accessing the website until the operator fixes the issue.
If you entered a password or similar information, you should change that password as a precaution.
## What should site operators do? Deleting it is not enough
If you operate a website and your website shows the polyfill.io dialog, remove the polyfill.io load immediately.
Search your source code for strings like the following.
- polyfill.io
- cdn.polyfill.io
- polyfill.min.js
Because users may leak personal or confidential information, you should consider taking the website offline temporarily if you cannot remove it right away.
polyfill.io exists to let older browsers use modern features, so removing polyfill.io may prevent some older browsers from viewing the website.
That said, polyfill.io no longer functions as a polyfill. If an environment would break after removing polyfill.io, it likely does not work now either, so removing it should cause few practical problems.
If you still need a polyfill, replace it with a trusted source such as Cloudflare’s mirror.
```html
```
:::caution
If you read this article and are about to replace the code with the snippet above, take care. Can you trust this article? The code above uses Cloudflare’s official mirror, but you should not copy and paste code you found online when you cannot verify whether you can trust it.
:::
Keep in mind that removing or replacing polyfill.io alone does not solve the problem.
First, in 2024, polyfill.io may have redirected some website visitors to scam websites. Second, users may have leaked personal or confidential information through the dialog that appears now.
In 2024, the web industry covered the polyfill.io issue as a major incident, so few website operators likely introduced polyfill.io after it became malware.
For that reason, most affected websites likely had been loading polyfill.io since before 2024, which means they may have redirected some visitors to scam websites during the 2024 supply chain attack.
In addition, some customers may have entered personal information, passwords, or similar data into the dialog that appears now. In that case, your website may have caused a leak of customers’ personal information.
This is why I said you should take your website offline if you cannot remove polyfill.io right away.
Standard access analytics also cannot tell you whether customers entered information into the dialog.
We do not know whether the polyfill.io side collected the entered information, but we also have no proof that it did not. You should treat any entered information as leaked.
You may therefore need to handle the incident as a data breach, not merely remove polyfill.io.
In addition, any website that left polyfill.io in place for nearly two years may have other vulnerabilities, or security issues, and the website’s management practices may have problems.
I urge you to inspect the rest of the website as well.
## Conclusion
If a dialog asks you to enter a username and password for polyfill.io, do not enter any information. Contact the website operator.
The dialog appears because the website loads polyfill.io.
Attackers used polyfill.io in a past cyberattack, and the domain had been disabled, but it may have come back online in late May.
If your website shows this dialog, remove polyfill.io at once, inspect the entire site, investigate the scope of impact, and handle the incident as a possible data breach.
## Verification details and sources
### Verification environment
Desktop
- OS: Windows 11
- Browser: Zen Browser v1.20.2b and Chrome v149.0.7827.103
Mobile
- OS: Android 17
- Device: Google Pixel 8
- Browser: Firefox Nightly for Android version 153.0a1, Chrome for Android version 149.0.7827.59, and Edge Canary for Android version 151.0.4083.0
### Verification details
I confirmed that the polyfill.io authentication screen appears on affected websites and that the same authentication screen appears when accessing polyfill.io directly. I also confirmed that the domain registration information for polyfill.io was updated on May 21, 2026, and that the polyfill.io website had returned at least during the period from May 23 to May 30.
### Last verification date
2026-06-10T07:00:00.000Z
### Changelog
- June 2, 2026: Published the first version
- June 10, 2026: Added verification environment
### Reference links
- [Post by the official VoiSona X account](https://x.com/VoiSonaOfficial/status/2061122003038580753)
- [Akamai’s report on polyfill.io](https://www.akamai.com/ja/blog/security/polyfill-supply-chain-attack-what-to-know)
- [Cloudflare’s report on polyfill.io](https://blog.cloudflare.com/automatically-replacing-polyfill-io-links-with-cloudflares-mirror-for-a-safer-internet/)
- [polyfill.io Wayback Machine archive](https://web.archive.org/web/20260000000000*/http://polyfill.io/)