Poisoned BootCDN tld.min.js served in Funnull CDN supply-chain attack

Arnold Chan@slaz

•updated Sep 6, 2026•0•0•1

Detects evidence of malicious file tampering on public CDNs (bootcdn.net, bootcss.com, staticfile.org) associated with the Funnull campaign. The rules identify specific malicious file hashes and anomalous oversized file sizes that indicate the presence of injected malicious loaders within common JavaScript libraries.