When we say the scripts can do anything at all this can be so many different things. Because it can modify the theme on demand this also means it can avoid detection by only appearing at certain times of the day. This allowed it to make any modifications it wanted to the theme, including adding scripts that do anything at all. In the suspicious script we found above, the app in question had read/write theme permission. This can be things like reading your products, manipulating your data or even modifying your entire theme.Īpps can have a lot of power! Granting it permission to read and write your data and theme can impact both your business and your customers. When you install a Shopify app the permissions it requires to do its thing are requested from you.
The app developer was removed from the Shopify App Store (presumably for some shady behaviour like this!) but their apps were still active in many, many Shopify stores.Įven though this app and suspicious script were nothing to do with our app, we helped our Plug in Speed users clean it up for no charge. Want to see the script for yourself? We’ve saved the suspicious script here.Įventually we tracked this script to a free Shopify app. Our best analysis is that this script is inflating visitor numbers on other shops. For those it makes a request to another website’s product page. In reality what it was doing was very obscure, all we know is it tries to hide itself and sleep for a lot of different requests apart from some very specific criteria. It called itself ‘jQuery’ but did none of the things jQuery does.
However we found these shops had a script that was pretending to be jQuery but was in fact very suspicious. It’s a good library and nothing to be concerned about. There’s a popular JavaScript library (useful code) called jQuery: it’s in just about every Shopify store.
We investigated and were shocked by what we found. Last week users of Plug in Speed got in touch to report some unusual goings-on in their shops.
0 kommentar(er)
