I think you're trying to muddy waters here (along with several of the other replies I've responded to). These websites are not necessarily hosting the malware themselves. Even these script vendors don't necessarily know either. That's what makes it a supply chain attack. I've been very clear about implementation to mitigate against this.

Hardly anyone ever thinks about this despite it being a gaping hole. For all the whining I've ever heard about package managers like npm, this one is even uglier and likely being exploited right now. Its dynamic behavior is by design making it very hard to reliably demonstrate when it's being exploited, but it's a hole nonetheless.

It's perfectly actionable to stop using 3rd party scripts the way I outlined in a reply to a sibling comment. I'm not sure what else you need me to say.

It's very simple. Don't open up your web server's content security policy to domains that you "trust" just because a big name company tells you to. The only rub is that it directly contradicts all the instructions every analytics/ad provider gives for their scripts. Is that the real reason why you're saying it's "not actionable"?