Trusted Script → Malicious Injection

This page loads trusted-vendor.js — a script your security team reviewed and approved. However, the vendor's build pipeline was compromised and the script now dynamically injects evil-payload.js, a script never seen before on your site.

📜 Attack Flow

  1. 1 Page loads trusted-vendor.js — previously reviewed & allow-listed.
  2. 2 Compromised code inside the vendor script calls document.createElement('script') to inject evil-payload.js.
  3. 3 The injected script runs a C2 beacon and tries to exfiltrate cookies & local storage.

🛡️ How Page Shield Catches This

  • ✓ Script Monitor detects a new script URL (evil-payload.js) that was never part of the baseline.
  • ✓ Code Change Detection flags that trusted-vendor.js has been modified since the last hash was recorded.
  • ✓ Malicious Code Analysis scans the new script and identifies data-exfiltration patterns.
  • ✓ Alert fires → security team is notified via email / webhook / PagerDuty within seconds.
  • ✓ If a Block Rule is configured, the injected script is prevented from executing entirely.

▶️ Live Demo

Click the button below to load trusted-vendor.js. Watch the console and the status panel to see the injection happen in real-time.

Waiting to load vendor script…

Console Output

Waiting…

Why CSP Alone Isn't Enough

Scenario CSP script-src Page Shield
Trusted vendor script is allow-listed Allowed Allowed
Vendor script content changes (supply-chain compromise) Still Allowed — same origin Alert — hash / content changed
Compromised vendor injects script from same origin Still Allowed — same origin Blocked — unknown script URL
Vendor injects script from new external origin Blocked — if origin not listed Blocked — unknown script + origin