chore(mkdocs.yml): Remove polyfill.io from extra_javascript
What the developer wrote
Authored by SatsCzar
chore(mkdocs.yml): Remove polyfill.io from extra_javascript
What changed, and why it matters
This commit removes a reference to polyfill.io from the project's documentation website configuration. Polyfill.io was a widely used service that provides JavaScript code to help older browsers support modern web features. In 2024, the polyfill.io domain was acquired by a new operator and was reported to have served malicious code to some users through a supply-chain attack. Removing it reduces the risk that visitors to the documentation site could load untrusted or malicious JavaScript. However, this change only affects the documentation website, not the Krux device firmware or wallet software itself.
Verify that the live documentation site has been regenerated and no longer requests polyfill.io. Review other external script dependencies in mkdocs.yml for trustworthiness. Consider pinning or self-hosting remaining third-party assets. No action is needed on Krux devices themselves.
Security signals we found
Removal of third-party JavaScript dependency from documentation site configuration
Dependency on polyfill.io, a service publicly reported to have served malicious code after a 2024 domain transfer
Supply-chain risk reduction for documentation site visitors
No change to device firmware, wallet logic, or cryptographic code
Evidence from the diff
The commit deletes one line from mkdocs.yml: the extra_javascript entry that loaded https://polyfill.io/v3/polyfill.min.js?features=es6. MkDocs uses this configuration to inject third-party scripts into generated documentation pages. The polyfill.io service was publicly reported in 2024 to have been involved in a supply-chain incident after its domain changed hands, with some users receiving injected malicious JavaScript. The patch removes the external dependency, which is a defensive hardening step. The remaining scripts (require.js and MathJax from cdnjs.cloudflare.com) are unaffected.
Changed components
mkdocs.yml documentation site configurationKrux documentation website (MkDocs-generated pages)Inspect captured patch +0 / −1
diff --git a/mkdocs.yml b/mkdocs.yml
index b170032..6ca3e72 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -19,7 +19,6 @@ markdown_extensions:
emoji_generator: !!python/name:material.extensions.emoji.to_svg
extra_javascript:
- - https://polyfill.io/v3/polyfill.min.js?features=es6
- https://cdnjs.cloudflare.com/ajax/libs/require.js/2.3.4/require.min.js
- https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.7/MathJax.js?config=TeX-MML-AM_CHTML
Why this scored 46/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.