Third-party JavaScript risks arise from the extensive use of externally sourced scripts in web applications, including analytics platforms, advertising networks, social media widgets, customer support tools, and payment processing libraries. Each third-party script executes with the same privileges as first-party code, creating potential for data exfiltration, session hijacking, and formjacking when any included script is compromised.
Modern web applications commonly load 30-50 third-party scripts, each of which can read page content, intercept form submissions, modify the DOM, access cookies, and communicate with external servers. Supply chain attacks targeting popular script providers affect all websites that include the compromised script. Magecart-style formjacking attacks inject payment card skimmers through compromised third-party scripts on e-commerce sites. Compromised analytics scripts exfiltrate session tokens, form data, and user behavior information. Malvertising delivers malware through advertising network scripts that change content dynamically. Even without compromise, third-party scripts create privacy risks through extensive data collection and cross-site tracking. Performance impacts include increased page load times and JavaScript execution overhead that degrades user experience.
Organizations have limited visibility into and no control over the behavior of third-party scripts after including them. A script that behaves normally during evaluation may be modified at any time by its provider -- legitimately or through compromise. Subresource integrity (SRI) helps but breaks when scripts are intentionally updated. Content Security Policy provides boundary controls but cannot prevent data exfiltration through the script's own domain. PCI DSS 4.0 now explicitly requires monitoring and managing all third-party scripts on payment pages, making this a compliance requirement for e-commerce.
CDA addresses third-party script risk through Vulnerability and Surface Defense missions focused on web application supply chains. Our guidance covers script inventory management, CSP configuration, runtime monitoring for behavioral anomalies, and the emerging adoption of isolated execution environments that limit third-party script capabilities.