Product
The Social Security Administration genesys toolkit and the bundled Mavo v0.2.0 library contain hardcoded references to the hostile-owned cdn.polyfill.io domain, posing a supply-chain risk of malicious script injection into downstream applications.