E.g. I have compared the hash of jquery.js and verified that it matches the hash on the official website. I then insert the link on my webpage. 2 week later, the CDN replaces it with a malicious copy with a keylogger embedded. When a client visits my webpage, the malicious script is downloaded and logs all input and posts it to their server.