148 INFECTED SHOPIFY themes MAY 2023 | Supply chain attack

DISCLAIMER: these INFECTED Shopify themes MAY 2023 are critical security vulnerabilities, that are self-inflicted. As an admin, an employee or owner – anyone can upload to their hosting environment an infected file as the latest archive of YOUR Shopify theme. Trusting a simple file download, even for a well-known source, developer or marketplace is not a safe bet lately. Please scan all your uploads before they reach your Shopify platform.

Who is to blame for the INFECTED Shopify themes MAY 2023?

This is where things get a bit tricky. Paranoia is activated and ZERO TRUST is enforced.

The first link is the gated Shopify platform itself. Shopify Inc. is a Canadian multinational e-commerce company founded in 2006. So they are not newcomers, nor are they inexperienced in the workings of the modern online internet. Nor are they cash-strapped, with annual revenues in the single-digit billions of US dollars. They do not lack experienced teams of experts as they employ over 11,000 people. They use proprietary, well-guarded code to run their business. (everyone else runs on open source). With all these resources, all these years, and with this huge number of INFECTED SHOPIFY themes MAY 2023 makes you belive: they are the problem. Does this sound familiar for an European: allowing to escalate, month after month, year after year, while directly hurting those who actually pay?

The second link is the development team itself. When contacted, they have no idea how their archive got infected, and they always immediately provide clean archives via other AND DIRECT channels, such as email, file sharing during an online chat, or secure cloud storage providers. As this has happened to several individuals and companies we have worked with over the years – they remain on the suspect list, but considering their innocence, they have more to lose than to gain with unethical approaches like this.

The third link is their hosting provider, which takes many forms based on individual business decisions. Some use their own environment and blame their own hosting. Fresh hosting antivirus scans never reveal anything. The conspiracy only raises more questions than it answers. Since this is becoming more and more common, we decided to just inform the owner and let them figure out how a clean archive got infected after upload.

The fourth link are marketplaces, where all control is lost, for both parties involved: seller and buyer. The developer (the so called seller) simply uploads his products, and you and I as customers, (the so called buyers), simply order those products. Once payment is confirmed, the direct download link is provided and you download the purchased Shopify themes. As the majority of these downloads are always personalised with a unique link, so one customer could not give another customer the same download link to a product they have not paid for – it makes you even more paranoid. Why is my marketplace trying to infect me? Questions that always hit a brick wall, with polite but succinct disclaimers that this sort of thing can happen from time to time.

And we agree. From time to time, these annoyances do happen. But when we see multiple attempts to infect us and our customers on a weekly basis, then IT IS SUSPICIOUS. If it happens several times with the same product in a single month, then IT IS PARANOIA. If it happens across multiple personal and business accounts, across multiple channels, across multiple links in the supply chain (developers, storage providers, marketplaces, CDNs), then IT IS PERSONAL.

Ethical online business is something we all want, but nobody does. And most importantly, by our silence, we allow free reign to those who think they can do anything, get anything, by lurking in the shadows. We simply want to raise awareness. Hopefully you, dear reader, will understand to scan all Shopify themes BEFORE you upload them to your PAID TO BE MANAGED Shopify platform.