The new Chinese owner of the popular Polyfill JS project injects malware into more than 100 thousand sites.