WAGD, an Australian online dog-harness retailer, remains closed on Shopify's advice days after malicious JavaScript delivered through third-party theme extensions redirected at least one shopper to a fake checkout page. The compromise began on 13 October. Logbase, maker of the Selleasy upsell app, confirmed that an unauthorised party accessed an internal tool and added a malicious script affecting a number of stores, while HulkApps disclosed a similar compromise in which a function named "hijack" intercepted checkout clicks and diverted shoppers to lookalike payment domains. The incident is the app-store supply-chain risk in concrete Australian form: merchants grant privileged code access to third-party extensions that run inside the checkout flow, so one compromised vendor can affect many stores simultaneously. Australian retailers should audit installed checkout extensions against the vendors' advisories, review who can publish to their store, and treat unexpected checkout redirects as an active incident until proven otherwise.

• Source article