script frontend injecté

Attack method reported in a June vendor-compromise incident that drained funds via a script injected into the frontend.