How would we know if malicious code was hiding on our site?

The question

The prompt for this one: Cloudflare's security team recently disclosed four malicious JavaScript campaigns running across e-commerce storefronts, hijacking affiliate commissions and running an ad-fraud and remote-code-execution backdoor. Seven of the eight payloads they found were completely absent from VirusTotal. A public scanner returned no malicious verdict for any of them. One version had sat publicly indexed with "no classification" for nearly two and a half years, including during a direct scan.

What we told them

The honest answer is: probably not, at least not from the checks most businesses actually run. The malicious scripts in the Cloudflare case used gated, condition-dependent execution — they checked the visitor's device, time of day, geography, and referrer before deciding whether to activate. A scanner crawling the site from a data center, at a random time, with no referrer, simply never triggers the payload. It sees a clean page because the malicious version of the page was never shown to it.

That's the core problem with relying on "we ran a scan and it came back clean" as your evidence of safety. A scanner only tells you the page was clean under the exact conditions of that one check. It says nothing about what happens to a real visitor, on a real device, at 2pm on a Tuesday from a specific country — which is exactly the audience this kind of malware is built to target and exactly the audience a one-time scan doesn't represent.

The symptoms are also easy to miss because some of these campaigns specifically target the metrics you'd normally trust to reassure you: one version disabled analytics and support chat for paid mobile traffic, so the dashboard you'd check for something looking "off" was quietly blinded for the exact visitors most worth watching. If your gut check is "traffic and conversions look normal," that's precisely the number a sophisticated script can manipulate.

Three things worth doing instead of trusting a one-time scan: ask whoever manages your site whether they run continuous client-side monitoring, not just a scan at deploy time — code that was clean when it shipped can be modified by a compromised third-party tag or script anytime after; watch for behavior that varies suspiciously by device or region (unexplained gaps between mobile and desktop conversion, or between countries) rather than assuming a stable topline number means nothing is happening; and treat vague customer reports — "the checkout looked weird," "it redirected somewhere strange" — as a lead worth investigating rather than a one-off glitch, since gated malware often only shows itself to a fraction of real visitors.