MAL-2025-33134 Malicious code in shopify-payments-terms (npm)

The package shopify-payments-terms was found to contain malicious code...

MAL-2025-33133 Malicious code in shopify-payments-configuration (npm)

The package shopify-payments-configuration was found to contain malicious code...

Malicious code in shopify-payments-terms (npm)

The package shopify-payments-terms was found to contain malicious code...

Malicious code in shopify-payments-configuration (npm)

The package shopify-payments-configuration was found to contain malicious code...

Shopify: Using GraphQL, STAFF with NO explicit permissions on Store can retrieve Shopify Payments Balance.

Hi, I am reporting this because it looks like a authorization bug in GraphQL. A staff member having no explicit permissions on a Shopify Store may be able to retrieve the Current balances in all currencies for the account for Shopify Payments. Steps 1. STAFF account is created and assigned NO...