Hacker News Reader

Yup.

Correct. The source subdomain of the popup seems to be hxxps[:]//polyfill[.]archive[.]org

It looks like it is running the service that was part of the supply chain attacker earlier this year. https://github.com/polyfillpolyfill/polyfill-service/issues/...

That was a DNS hack of polyfill.io though right? This looks like it was/is self hosted.

The service was fine, it was the "official" hosted instance of the service which was compromised. IA appears to be running their own instance.

Yeah I'm getting this exact response from the above URL now:

Seems like they self hosted that service