49 matches found
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication in the currentshopifydomain helper. An attacker can gain unauthorized access to resources belonging to a different shop by sending a request authenticated for one shop while including a different shop in the quer...
Malicious Package
Overview shopify-app-bridge-internal is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
Malicious code in shopify-app-bridge-internal (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b21c63417fe3a82fd514d0af7c913fb3c1cd62915839dc8910483fb6484bbbd9 The package's preinstall lifecycle script in package.json runs unconditionally on npm install and issues an HTTPS GET to...
MAL-2026-5452 Malicious code in shopify-app-bridge-internal (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b21c63417fe3a82fd514d0af7c913fb3c1cd62915839dc8910483fb6484bbbd9 The package's preinstall lifecycle script in package.json runs unconditionally on npm install and issues an HTTPS GET to...
Malicious code in shopify-app-extension-template (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf25a3a07b9adf8865f783819176d646b7c5485aeb1539422555bf596abfeaa7 The package shopify-app-extension-template was found to contain malicious code. Source: ossf-package-analysis...
MAL-2026-3051 Malicious code in shopify-app-extension-template (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf25a3a07b9adf8865f783819176d646b7c5485aeb1539422555bf596abfeaa7 The package shopify-app-extension-template was found to contain malicious code. Source: ossf-package-analysis...
Malicious code in shopify-app-react-router (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d58b68abe183faeee5b24e4b524d982d1c78881c8d0c48dd847411bf8fc087e6 The package shopify-app-react-router was found to contain malicious code. Source: ghsa-malware...
Malicious Package
Overview shopify-app-react-router is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
MAL-2025-192977 Malicious code in shopify-app-react-router (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d58b68abe183faeee5b24e4b524d982d1c78881c8d0c48dd847411bf8fc087e6 The package shopify-app-react-router was found to contain malicious code. Source: ghsa-malware...
EUVD-2025-27145
Malicious code in bioql PyPI...
CVE-2025-55998
A cross-site scripting XSS vulnerability in Smart Search & Filter Shopify and BigCommerce apps allows a remote attacker to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into several filter parameter...
CVE-2025-55998
A cross-site scripting XSS vulnerability in Smart Search & Filter Shopify and BigCommerce apps allows a remote attacker to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into several filter parameter...
CVE-2025-55998
A cross-site scripting XSS vulnerability in Smart Search & Filter Shopify and BigCommerce apps allows a remote attacker to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into several filter parameter...
PT-2025-36477
Name of the Vulnerable Software and Affected Versions: Smart Search & Filter Shopify App version 1.0 Description: A cross-site scripting XSS vulnerability exists in Smart Search & Filter Shopify App. A remote attacker can execute arbitrary JavaScript in a user's web browser by including a malicio...
CVE-2025-55998
A reflected Cross-Site Scripting (XSS) vulnerability exists in Mezereon's Smart Search and Filter app for Shopify and BigCommerce (version 1.0). The root cause is a lack of parameter value sanitization , which allows a remote attacker to inject and execute arbitrary JavaScript in a user's web bro...
Malicious code in shopify-app-express (npm)
The package shopify-app-express was found to contain malicious code...
Malicious code in shopify-app-session-storage-mongodb (npm)
The package shopify-app-session-storage-mongodb was found to contain malicious code...
Malicious code in shopify-app-session-storage-postgresql (npm)
The package shopify-app-session-storage-postgresql was found to contain malicious code...