Inside the CSS code they add a CSS variable which stores the URL location of the web skimmer code they want to load inside a hacked store.