I think you're trying to muddy waters here (along with several of the other replies I've responded to). These websites are not necessarily hosting the malware themselves. Even these script vendors don't necessarily know either. That's what makes it a supply chain attack. I've been very clear about implementation to mitigate against this.

Hardly anyone ever thinks about this despite it being a gaping hole. For all the whining I've ever heard about package managers like npm, this one is even uglier and likely being exploited right now. Its dynamic behavior is by design making it very hard to reliably demonstrate when it's being exploited, but it's a hole nonetheless.

It's perfectly actionable to stop using 3rd party scripts the way I outlined in a reply to a sibling comment. I'm not sure what else you need me to say.

It's very simple. Don't open up your web server's content security policy to domains that you "trust" just because a big name company tells you to. The only rub is that it directly contradicts all the instructions every analytics/ad provider gives for their scripts. Is that the real reason why you're saying it's "not actionable"?

If we're really being serious about getting it fixed and not just waving a magic wand and laying blame, the scripts should not be distributed via a platform that tells web maintainers to blindly paste a script tag and leave their web servers wide open for the whitelisted 3rd party domain(s) to send whatever they want to visitors. We need to end the security theater with nonces that is bypassing what most people expect from a content security policy that is almost never true in practice.

The scripts should be 100% static files hosted by the same origin and not be obfuscated. These scripts should not make additional requests to inject even more scripts that cannot be known until run time and are specific to that targeted visitor. These scripts should be released in the usual semver tradition with matching hashes that never change without the explicit action by the same domain that the user actually visited (making the nonce obsolete).

Like I said, this is a very old debate with a very simple solution whose only problem is that it breaks the business model of a multi-billion dollar idea. Not only would this tighten up security, but your favorite websites wouldn't lag so hard anymore either. The vast majority of complaints about the web being slow are from the dozens of HTTP requests constantly being made behind your back. This is exactly why so many users feel forced to use an adblocker even though that doesn't always work.