polyfill.io login popup when using donate homepage item

[mkurios]

I started noticing yesterday that my homepage now has a popup to login at polyfill.io.
I did some testing and this no longer comes up when I disable the donate homepage item.
I checked and I am using the official organizr/organizr:latest docker build v2.1.5000.
Any idea what this is ? I'm reading some dodgy things about this polyfill.io.

[causefx]

do you have custom html on homepage? it may be a module from there?
i can test on my instance too

[mkurios]

I checked 'customhtml' item is disabled. I only had it on my homepage and disabled most of the modules and noticed it was gone, then re-enabled one-by-one and triple checked it was the donate item.
I had a look through dev tools\network in the browser, and I do see it calling JS from polyfill.io, specifically:
https://polyfill.io/v3/polyfill.min.js?version=3.52.1&features=fetch&_=1783222182260
that also gives the same login form. Had a look at this going through the local IP of the docker instance, and it still shows, so it is coming from the docker for some reason.

[mkurios]

this call to polyfill.io is directly in https://github.com/causefx/Organizr/blob/v2-master/api/homepage/donate.php
calling anything from 'polyfill.io' seems to give this login prompt.
apparently since may this malware site has become active again...
https://www.bleepingcomputer.com/news/security/suspicious-polyfill-login-prompts-pop-up-on-toshiba-muji-websites/
https://www.reddit.com/r/sysadmin/comments/1ttjp1i/suspicious_login_popup_from_polyfillio_on/

i had a look and donate.php seems to work fine if you remove that line that calls polyfill.io.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

[mkurios]

don't know if i need to do a pull request for this, not a programmer so I dont have the tools....
I've just disabled the plugin for now but I still suggest this needs fixing as its a security issue.... at least i'm not ai ;)....

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.