Malware comes in many choices, meaning that if a program starts to infect many pages you need get rid of those fast.
rebuilding with a backup is safest.
To pull all those infected codes out is tricky and wont close the hole the malware infected you in the first place.
Similar to a windows malware infection, rebuilding is most of the times best.
If polyfil is malware, originally surely not. https://www.geeksforgeeks.org/how-to-use-polyfill-in-javascript/