Looks like Polyfill.io was sold to a Chinese company that offers CDN/DDOS protection services. Not to say they aren't trustworthy, but allowing a company to load a script on your page implicitly requres a lot of trust, and is the reason why many don't even load google analytics. In most cases you don't even need polyfill.io so its worth checking if you can remove it More info: x.com/triblondon/sta…