Poyfill.io claims reveal new cracks in supply chain, but how deep do they go?