Claude Code Security and Magecart: Getting the Threat Model Right

This article explains why static code analysis tools like Claude Code Security cannot detect Magecart-style web supply chain attacks that execute entirely at runtime in the browser.

• •A real-world Magecart skimmer used a three-stage loader to hide its payload inside a favicon's EXIF metadata, executing via new Function() without ever touching the merchant's source code
• •The attack chain loads a script from a spoofed Shopify CDN URL, decodes an obfuscated target domain, parses binary image data, and silently POSTs stolen payment data to an attacker-controlled server
• •Claude Code Security is limited by design to analyzing code within repositories, giving it no visibility into compromised third-party CDN scripts, binary asset payloads, or real-time browser network requests
• •Other supply chain vectors include malicious iframe injection, pixel tracker abuse, and DOM-based credential harvesting — all executing outside the repository