The attack you are referring to is known as
Magecart, which targeted scripts for Magento. This attack compromised thousands of sites, including British Airways and Ticketmaster, and others. It was used to steal credit card information of hundreds of thousands of users of these sites. See https://www.csoonline.com/article/3400381/what-is-magecart-how-this-hacker-group-steals-payment-card-data.html for more info.
integrity attribute of the
integrity attribute. If there is a mismatch, then that could mean that the script has been tampered with, and the browser aborts the loading of the script.
And if you did do it, wouldn't it be immediately noticed by the people
Probably not. Many sites incorporate scripts that run in the user's browser, and send data to servers (via XHR, Ajax, etc.) routinely. Unless users were using the developer tools function in the web browser to monitor the browser's network activity, or run some other network monitoring tool, it is unlikely that they would have noticed anything unusual.