Can my WAF see when third-party scripts change and potentially become malicious?

WAFs don't perform content analysis of JavaScript files, and especially if the malicious payload originates from a 3rd party URL, the WAF would not live in the flow of the request. They only validate that the HTTP request itself to the web server appears legitimate. When a third-party script gets updated with malicious code, your WAF treats it the same as any other update from that trusted domain. WAFs lack the capability to hash, analyze, or compare script versions to detect when legitimate code becomes compromised, which is exactly how supply chain attacks like Polyfill succeed.