�� A Magecart skimmer hid its payload in a favicon’s EXIF metadata, never entering the codebase.

A fake CDN script fetched the image, decoded a hidden URL, and executed it in the browser.

No repo changes. No scan alerts. Payment data was exfiltrated at checkout.

�� Loader chain and why static tools missed it → https://thehackernews.com/2026/03/claude-code-security-and-magecart.html