Anything in a front-end bundle is public: there are no client-side secrets. Untrusted HTML injected into the page can steal sessions and swap wallet addresses, and a compromised npm dependency can do the same.
el.textContent = userInput; // safe el.innerHTML = userInput; // XSS
Pin dependencies, review lockfile changes, use a content security policy, and always display the exact address and amount the user is about to sign.