Polyfill.io

United States · polyfill.io · 1 vendor

Funnull Technology Inc. is a Philippines-based company that provides computer infrastructure and hosting services for websites. In February 2024, it acquired the Polyfill.io domain, which delivers an open-source JavaScript library for browser compatibility. The company has been identified and sanctioned by the U.S. Treasury for facilitating virtual currency investment scams.

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 1 sub-vendor.

Insights

Last updated 2026-08-04 · revision 1

1 direct vendor, 62 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 6/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Polyfill.io demonstrates medium migration readiness. A significant strength is the reported 'Total Vendors: 0', which implies a complete absence of external vendor lock-in. This greatly simplifies migration planning and execution, as there are no complex vendor contracts, dependencies, or data egress fees to manage from third-party providers. The internal tech stack, including Node.js, Nginx, and Linux, is relatively modern and not considered legacy, which should facilitate migration to contemporary cloud environments. However, several factors reduce the readiness score. There is no available data on financial stability, which is crucial for assessing the company's ability to fund a potentially extensive migration. Regulatory environment and data residency requirements are also 'Not specified', posing significant unknowns and potential compliance challenges during a migration. The internal complexity of their Anycast Networking and BGP Routing Infrastructure, which underpins their CDN, could present a challenge if a complete re-architecture or replication of this specialized infrastructure is required in a new environment. The necessity to migrate away from a compromised system might also necessitate a more thorough and complex re-design rather than a simple lift-and-shift.

Financials

Three-year financials

Financial Resilience Score: 1/10

Polyfill.io was never a traditional operating company with published financial statements. It began as a free, open-source web-developer utility created by Financial Times Labs around 2013-2014 and maintained by a community of contributors. As a free CDN service, it never generated meaningful commercial revenue, never filed with the SEC, and never had audited public financial statements. There are no revenue, EBIT, or equity figures available in the public record. The service's financial and operational resilience collapsed entirely in 2024. In February 2024, the domain was sold to a Chinese-linked company called Funnull. In June 2024, security researchers discovered malicious JavaScript injections affecting an estimated 100,000+ websites, triggering one of the largest supply-chain attacks of the year. Cloudflare, Fastly, Google, and Namecheap responded by mirroring, blocking, or taking down the service. The GitHub repository was disabled, and in June 2025, the U.S. Treasury's OFAC sanctioned Funnull Technology Inc. The service is now effectively defunct with no viable going-concern status.

Key strengths: Wide adoption footprint of over 100,000 websites at peak, Trusted developer-friendly reputation under original FT/Betts stewardship, Low operating cost as a static CDN service, Free open-source model with community backing

Risk factors: Governance risk - domain ownership separate from code/community, Supply-chain risk - production sites embedded script tags without SRI integrity checks, Reputational risk - brand destroyed after June 2024 malicious injection incident, Legal/regulatory risk - acquirer Funnull sanctioned by OFAC in June 2025, Going-concern risk - service is defunct, domain de-registered, browsers actively block it, No revenue model or audited financials ever existed

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report