Comment by Aachen

You mean the IA included some JS polyfill from a subdomain and that's what's compromised / where the alert is coming from?