But my question is, how did they go about putting the malicious code there in the first place?
From another source : "Volexity believes that the Newegg website may have been compromised and actively facilitating financial theft for over a month. A key date in the Magecart attacks against Newegg come from the registration data of the neweggstats.com domain. The domain was registered on August 13, 2018 at approximately 16:36 UTC via Namecheap. This indicates the attackers had likely already compromised the Newegg website and were preparing to launch attacks. WHOIS information form the domain shows it was registered with privacy protection" Source : (https://www.volexity.com/blog/2018/09/19/magecart-strikes-again-newegg/