What a blunder.

I think even the worst static code analyzers would have caught this.

Looking at the code that was injected by an attacker it seems like they were trying to extract user sessions and exfiltrate it.

https://programming.dev/post/532566

I found myself asking the same thing: https://news.ycombinator.com/item?id=36662195