Code written by someone else can still move your users' money, as long as your site loads it. On October 29 a hijacked page-speed script, loaded by prediction market Polymarket, sold positions for some signed-in traders and sent about $2.7 million to the attackers, according to The Hacker News. SecurityWeek reports a malicious Claude Code extension served through a Cursor supply chain attack that performed host reconnaissance and tried to open a reverse SSH tunnel. The Hacker News also reports attackers going after an unpatched maximum-severity flaw in the CryptoPayment Gateway WordPress plugin that can expose wallet credentials. Different victims, one pattern. The most dangerous code in a product is probably the code nobody on the team wrote, reviewed, or keeps a list of. We review payment and account flows for exactly this: which external scripts your authenticated pages pull in, whether they are pinned or self-hosted, and whether anything in the browser is allowed to sign an action that moves value. A focused review of one flow takes days, not months, and you get cost and timeline within a day. Send us a message if you want your checkout and signed-in pages looked at.
Was this useful?