Last updated 20 October 2026.
Since 14 October, 135 apps have disappeared from the Shopify App Store. Some are household names: Privy, Rebuy, Boost AI Search & Filter, Consentmo, Swym Wishlist Plus, Color Swatch King, Upcart and Aftersell. In all, 9 had over a thousand reviews.
Coming straight after the checkout hijack, it's easy to read that as 135 hacked apps. It isn't, and it's worth being precise, because the thing that should worry merchants is something else.
What's known
Three vendors have said unauthorised code went out through their app: HulkApps (Hulk Product Options), Logbase (Selleasy) and Swym (Wishlist Plus). Privy and Boost have been named in public reports, but neither has confirmed checkout interception. Privy has only confirmed its pop-ups were disrupted.
For the rest, Shopify hasn't said why. It removes apps for policy, quality and technical reasons all the time, and 89 went on a single day, 15 October. Asked by iTnews, a Shopify spokesperson said apps have to meet its security and privacy standards and "when an app falls short, we act", which can include delisting.
The list comes from heyapps.dev, which archives App Store listings. We checked the big names against the App Store ourselves. Our delisted apps tracker has the full table and is updated as vendors explain.
Delisted doesn't mean gone
Delisting stops new installs. It does nothing to the stores that already have the app. Its script keeps loading on their storefronts until the merchant uninstalls it.
We can see this on the stores our app monitor scans every six hours. After they were delisted, scripts from Rebuy Personalization Engine and AdRoll Advertising were still loading on live storefronts. None of those apps is linked to the hijack, and they may well be fine. But it's a reminder that what runs on your store is decided by what you've installed, not by what's on the App Store today.
That matters because of how the hijack worked. The bad code didn't arrive in a new version anyone approved. It came from the vendor's own servers, through settings the app fetched on every page load. Any storefront app can do that, listed or not.
What to do this week
- Go through your installed apps and compare them with the delisted list.
- If one of yours is on it, look for an explanation from the vendor before you rip it out. Many will come back.
- Uninstall anything you don't use, then check your theme's app embeds and code for leftovers.
- Check custom JavaScript fields in app settings for code your team didn't add.
- In a private window, go product, cart, then click your real checkout button, and read the address bar. It should show your domain or Shopify's checkout.
What we're doing
Revenue Shield runs that last step for you, on a schedule, on desktop and mobile, in a fresh browser every time. Since this week, every check also records where checkout actually landed and shows it next to the run, with a video. The app monitor lists the scripts loading on your storefront and tells you when one appears or changes.
The app itself adds nothing to your theme and only reads products. It's monitoring, not protection: it won't block an attack, but it shortens the time between something going wrong and you knowing about it.
Run a free scan and see where your checkout goes today.
