secure-checkout

The supplied code is a site-wide third-party tracking layout and does not implement the requested checkout isolation or CSP monitoring controls. Its main security risk is that analytics, chat, and advertising JavaScript may execute on checkout pages and could access page content if a provider is compromised. No direct credential theft, reverse shell, destructive behavior, or overt malware is visible in the supplied fragment. The requested output files were not provided or implemented here.

No executable source code was provided, so malicious package behavior cannot be assessed. The supplied product description contains clear stored-XSS test content and must be sanitized before rendering; script tags, javascript URLs, and event-handler attributes should be removed. The data itself does not demonstrate malware.