The popular polyfill.io JavaScript library has been used to inject malicious code into thousands of sites in the last few days.