Claude Code Security and Magecart: Getting the Threat Model Right

The article details a Magecart campaign that used a three-stage loader to retrieve a favicon from a CDN, extract malicious JavaScript embedded in the image's EXIF metadata, and execute it in the shopper's browser to steal payment data; it highlights that repository-based static analysis cannot detect this runtime supply-chain technique and recommends runtime monitoring alongside supply-chain governance and static analysis as part of a defense-in-depth approach.