Issue 254 - Inside the Shopify Checkout Hijack: How It Worked and How to Lock Down Your App
Checkout hijack: what's confirmed, what's conjecture, and what to test today
Taylor Page separates what's confirmed about the checkout hijacking campaign from what's still speculation. Starting around October 10, attackers tampered with merchant-editable settings in apps like Selleasy, Swym Wishlist Plus and Hulk Product Options so that clicking Checkout sent shoppers to a look-alike page that harvested card details -- Shopify's own checkout was never touched. The entry point was apps that store raw JavaScript as a setting and run it on the storefront. He ends with a concrete test: check out three times in a fresh incognito window and confirm you land on your own or a Shopify domain, plus an open-source checker from Dylan Pierce for anyone managing many stores.
By Taylor Page
How the Shopify checkout hijack worked, and which apps were hit
Anton Ekström walks through the attack Roman Zipp spotted while shopping for a keyboard: a third-party app fetched config from its developer's API, the response carried a script, and Checkout sent shoppers to a fake page that collected card details before passing them on to the real one. His list of affected apps, all now fixed or delisted: Qikify (July), Hextom (August), Hulk Product Options, Selleasy, Swym Wishlist Plus, and Privy (unconfirmed). Vendor statements point to unauthorized access to app configurations, internal tools and credentials rather than malicious code in the apps themselves. His takeaway: every app that loads code on the storefront is part of the checkout flow.
By Anton Ekström
The fake register: how a script tag hijacked Shopify checkouts
Very Bad Panda tears down the checkout hijack from the developer side. A third-party app's storefront script fetched a merchant-editable "custom JS" setting from its server and ran it with eval. The malicious version sent Checkout clicks to look-alike domains like biliing[.]top and checkout-confirm[.]top, harvested card details, then forwarded shoppers to the real checkout -- and it fired only once per session, which is why merchants testing their own stores saw nothing. The post then rates every Shopify surface that can run code: script tags, theme code, app-side custom JS and app proxies are high or medium risk, while checkout UI extensions, web pixels and Functions are sandboxed. The rule it lands on: never execute JavaScript that comes out of your database.
By Very Bad Panda
Shopify is asking every app developer to run a security scan this week
Shopify published a direct security ask: scan your app this week with the new AI Toolkit security check, a single prompt that looks for Shopify-specific vulnerabilities including unauthenticated endpoints and cross-shop data access. The framing is blunt -- attacks on the app ecosystem are increasing as AI gets better at finding vulnerabilities, and installation trust is the thing being exploited. If you have not run it, this is the week; the Partner Town Hall on Nov 5 includes the CISO.
By Shopify
Shopify's new app security check, and where it fits in your release process
Khalid Chao covers the new app security check, which flags issues like missing webhook verification, API routes without session token checks, and access scopes broader than the app needs. Run it with `shopify app security check`, or ask AI Toolkit with /shopify. Shopify recommends running it before submitting your app and on every release. His caveat: treat it as one layer alongside testing and code review, not a guarantee.
By Khalid Chao
The average Shopify app is doing worse than you think
Katie Keith of Barn2 ran the numbers on App Store saturation. There are now 8.8 apps for every thousand Shopify shops, up from 5.5 in July 2023, because the app count has grown more than 28% a year while shop growth slowed to 10-14%. Revenue is extremely concentrated: the 16 largest apps take 40.6% of it, and over half of all apps share 0.6%. She also explains how she estimated revenue for 1,675 apps and shares how Barn2's own first Shopify app has done since launch.
By Katie Keith
Mat De Sousa on where Shopify app founders go in the AI era
Mat De Sousa lays out three pressures on app founders. First, Shopify keeps absorbing surface area apps used to own, and it follows the same arc each time: nice to have, needed to grow, mandatory for new apps, then mandatory for all. Second, purely visual apps like banners and simple page builders are at risk unless they add real backend logic, such as a page builder that A/B tests sections based on visitor behavior. Third, with AI making code easy to copy, he argues the differentiator is human: relationships, and adding an agency layer.
By Mat De Sousa
Bastian Fritsch built his own app analytics dashboard after Mantle
With Mantle shut down, Bastian Fritsch skipped the third-party replacements (they cost money, you hand over your API keys, and they rarely fit exactly) and built his own analytics dashboard in about two hours of prompting. It covers MRR, subscribers and where they came from, a funnel wired to GA4 and BigQuery, reviews, and personal goals for the app. It runs free on Cloudflare Workers, with no third party holding the data.
By Bastian Fritsch
