I took from the article that the attacker had modified an existing copy of the Modernizr script that BA were running by appending content at the end of it. The

I took from the article that the attacker had modified an existing copy of the Modernizr script that BA were running by appending content at the end of it. The targeting of the attack and the fact that prior to that the file hadn't changed for 6 years make it unlikely that it was a downloaded copy that had been backdoored and then installed by BA.