Critical Severity Vulnerability in intersection-observer

[salzpate]

We actually want to use mdxeditor, which uses @react-hook/intersection-observer.

However, we have now been informed that the intersection-observer contained therein is highly vulnerable.

Since the intersection observer is a polyfill and has not been developed further since 2022, I wanted to ask if you could offer a new version without this polyfill or to replace it with another, see below.

It should now be usable by all modern browsers even without polyfill. https://caniuse.com/?search=IntersectionObserver

Vulnerability info:

A malicious Polyfill reference has been identified in this package. The issue is located in the file "package\intersection-observer-test.html". To address this security concern, we recommend taking one of two actions: either remove the affected file completely or replace the suspicious reference with a trusted alternative. Reliable Polyfill sources include Cloudflare (https://cdnjs.cloudflare.com/polyfill) and Fastly (https://community.fastly.com/t/new-options-for-polyfill-io-users/2540). Mend Note: For more detailed information about the Polyfill supply chain attack and its widespread impact, you can refer to our comprehensive blog post at https://www.mend.io/blog/more-than-100k-sites-impacted-by-polyfill-supply-chain-attack/.

Publish Date: 2024-07-04

[haidar47x]

+1