Actually, it's way worse than that. They were directly loading code from someone's CDN: https://github.com/iotaledger/trinity-wallet/pull/2565/files#diff-bafa02

Actually, it's way worse than that. They were directly loading code from someone's CDN: https://github.com/iotaledger/trinity-wallet/pull/2565/files#diff-bafa027c31caffa28093844213af12a7L38 https://github.com/iotaledger/trinity-wallet/pull/2565/files...