Store security

Delisted Shopify apps: the October 2026 list

By Gary Gillespie · Last updated

Updated 20 Oct 2026. The list comes from heyapps.dev, which archives App Store listings; we check the big names against the App Store ourselves and add what each vendor has said.

What delisted means

A delisted app's App Store page now says "This app is not currently available on the Shopify App Store". Nobody new can install it. Stores that already have it keep it, along with any script it adds to the storefront, until they uninstall.

Delisting is not a verdict. Shopify removes apps for policy, quality and technical reasons all the time, and it hasn't said why most of these went. The timing makes people nervous, but the only apps tied to the checkout hijack are the ones their own vendors confirmed.

When they were removed

Date (2026)Apps delisted
14 Oct2
15 Oct89
16 Oct11
18 Oct23
19 Oct1
20 Oct9

Most went on 15 October. Shopify hasn't said why, and that batch includes many apps nobody has linked to the attack.

Linked to the checkout hijack

AppDeveloperReviewsDelistedStatus
Privy ‑ Email, SMS & Pop UpsPrivy Operations4,23018 OctNamed in reports, not confirmed
Upsell & Cross Sell — SelleasyLogbase2,75215 OctVendor confirmed unauthorised code
Boost AI Search & FilterBoost Commerce1,63618 OctNamed in reports, not confirmed
Swym Wishlist PlusSwym Corporation1,48315 OctVendor confirmed unauthorised code
Hulk Product OptionsHulkApps1,21115 OctVendor confirmed unauthorised code

Privy ‑ Email, SMS & Pop Ups: Named in one public report. Privy confirmed a display disruption, not checkout interception.
Upsell & Cross Sell — Selleasy: Logbase confirmed an unauthorised party added a malicious script via an internal tool, on 13 Oct.
Boost AI Search & Filter: Named in public reports. The vendor's notice does not identify a phishing cause.
Swym Wishlist Plus: Swym described unauthorised configuration changes on 14 Oct; delisted for new installs.
Hulk Product Options: HulkApps disclosed that unauthorised code was added through the app.

Still running on live stores

On the stores our app monitor scans every six hours, we still saw scripts from Rebuy Personalization Engine and AdRoll Advertising loading on the storefront after those apps were delisted. None of them is linked to the hijack. It shows how delisting plays out in practice: the app leaves the store listing, not the stores.

Every delisted app with 100 or more reviews

AppDeveloperReviewsDelistedStatus
Privy ‑ Email, SMS & Pop UpsPrivy Operations4,23018 OctNamed in reports, not confirmed
Color Swatch King: VariantsStarApps3,19418 OctNo reason given
Upsell & Cross Sell — SelleasyLogbase2,75215 OctVendor confirmed unauthorised code
Consentmo GDPR ComplianceConsentmo2,03720 OctNo reason given
Boost AI Search & FilterBoost Commerce1,63618 OctNamed in reports, not confirmed
Shopacado ‑ Volume DiscountsShopacado1,49815 OctNo reason given
Swym Wishlist PlusSwym Corporation1,48315 OctVendor confirmed unauthorised code
Hulk Product OptionsHulkApps1,21115 OctVendor confirmed unauthorised code
Aftersell Post Purchase UpsellRokt1,08615 OctNo reason given
Upcart—Cart Drawer Cart UpsellRokt94715 OctNo reason given
Rebuy Personalization EngineRebuy85618 OctNo reason given
Langwill：AI Language TranslateRave Infosys Private Limited64315 OctNo reason given
Peek! ‑ Better Replay & SurveyCartKit63715 OctNo reason given
Custom Pricing: Wholesale B2BBold57115 OctNo reason given
Bold Discounts ‑ Flash SalesBold51715 OctNo reason given
AdRoll AdvertisingAdRoll32915 OctNo reason given
Bold Bundles ‑ Product BundlesBold26615 OctNo reason given
Musbu ‑ WhatsApp Chat ButtonCodexade23015 OctNo reason given
ZigZag Returns & ExchangesZigZag Global Ltd21215 OctNo reason given
MigrationPro: Store MigrationMigrationpro, LLC18615 OctNo reason given
Charge Me Later, Wholesale appBuddy Apps15215 OctNo reason given
iTable Compare & Pricing TableiTable by Identixweb10216 OctNo reason given
Sitemapper Pro SEO SitemapSitemapper10215 OctNo reason given

Plus 112 smaller apps. The full list is on heyapps.dev.

If you use one of these apps

  1. Check the vendor's own status page or email for an explanation before you act. Many of these apps will come back.
  2. If it's one of the confirmed apps, follow the vendor's guidance, and check that checkout goes to your domain or Shopify's (see below).
  3. If you no longer need it, uninstall it, then check your theme's app embeds and code for leftovers.
  4. Look for code your team didn't add in any custom JavaScript field in the app's settings.
  5. Test checkout like a shopper: private window, product, cart, your real checkout button, then read the address bar.

Or run a free scan. It goes through your checkout on desktop and mobile and shows where it landed.

Frequently asked questions

How many Shopify apps have been delisted?
135 apps had left the Shopify App Store between 14 Oct and 20 Oct 2026, according to the heyapps.dev archive.
Were Privy and Rebuy hacked?
Both are delisted. Privy was named in one public report but has only confirmed a display disruption. Rebuy has not been linked to the checkout hijack. Neither has confirmed unauthorised code.
Which apps are confirmed in the Shopify checkout hijack?
Hulk Product Options (HulkApps), Selleasy (Logbase) and Swym Wishlist Plus (Swym) have each said unauthorised code went out through their app in October 2026.
Does a delisted app stop working on my store?
Usually not straight away. Delisting stops new installs. The app and its storefront script keep running on stores that have it until they uninstall.

See it on your own store — free

Run a free checkout health scan on any live Shopify store. No install, no card. Results in about 8 minutes, with step-by-step video proof.

Scan my store freeor install on Shopify →

Rated 5/5 by merchants on the Shopify App Store