The bootstrap css file is being loaded from cdn.jsdeliver.net (one of the most trusted sources), the npm indicates it's coming directly from the official npm registry and the integrity SRI hash exists and is
valid.
I don't know where you got the trojan alert form, but it's definitely not from that CSS file.
Yeah, but most has been said, at least the information that matters... PHP version is the only thing we don't know, but even if it were php 10.5 and MySQL 11.3 running on CentOS 17 that was released in 2050, it wouldn't change the fact that the form doesn't contain products_id hidden field(s) so there's nothing to process.
My money is on includes/modules/pages/shopping_cart/header_php.php
