On October 10, 2026, Hulk Product Options sent some shoppers to a fake checkout page. HulkApps confirmed that "an exploit introduced unauthorized configurations into the Hulk Product Options app," which "affected the app's theme extension and redirected some checkouts to a fake external checkout page." Shopify temporarily disabled the theme extension, and HulkApps removed the code.
Days later, Selleasy and Swym Wishlist Plus confirmed similar attacks, and Shopify disabled Boost AI Search & Filter over a security issue. Our summary of the October incidents covers each one.
How it worked, and why your theme looked clean
Researcher Roman Zipp traced the attack. The app's normal theme script, served from Shopify's own CDN, requested store settings from HulkApps' servers on each page load. A "custom JavaScript" settings field held about 22 KB of code that redirected shoppers at checkout.
The merchant's theme and the app's code on Shopify were clean. The attack lived in a vendor-side settings field. A theme review wouldn't have found it. You had to watch the store in a browser.
Check your store now
- Test checkout the way a shopper would. Open a private window, add a product with options, click Checkout, and confirm you land on your real checkout. Repeat a few times: the script fired once per visitor and didn't trigger every time.
- Check your HulkApps settings for any custom JavaScript or HTML. Remove what you don't recognize.
- Change your HulkApps password and turn on two-factor authentication, there and for every Shopify staff and collaborator account.
- Check your other Hulk apps. HulkApps says only the Product Options theme extension delivered the redirect. Review the settings of any other Hulk app you run anyway.
- Make a list of what Hulk does on your store: which products use options, which options add to the price, and which feed your order fulfillment. You'll need it for any change.
Option 1: What Shopify does natively
Shopify's native options have expanded:
- Variants: products can have up to 2,048 variants, so many "option" setups can be real variants with their own SKU, price and inventory.
- Combined listings (Plus): separate products shown as one product page, such as one product per color.
- Line item properties: your theme can collect text, choices or dates on the product form and pass them to the order, with no app.
- Bundles: Shopify's free Bundles app handles fixed and multipack bundles.
Charging extra for non-variant options, such as engraving or gift wrap, still requires an add-on product in the cart or custom checkout logic.
Option 2: Another product options app
There are many product options apps, but we haven't audited them for this article. Before installing one, ask:
| Question | Why it matters |
|---|---|
| Can scripts or HTML be added through your dashboard? | That was the exact way in on October 10. |
| How do you charge for add-on options? | Some add hidden products to the cart, which can confuse reporting and fulfillment. |
| Can you import our Hulk option sets? | Rebuilding hundreds of option sets by hand is slow and error-prone. |
| Do you support two-factor authentication on every account? | Vendors that explained a cause pointed to compromised credentials. |
| What happens to the product page if your servers go down? | If options vanish, can shoppers still buy, or do orders arrive missing details? |
Option 3: Build options into your store
Product options affect revenue directly on the product page and in the cart. Owning that code pays off.
A custom build stores option sets on the product in Shopify, renders them in your theme, and passes them to orders as line item properties. A Shopify Function can adjust prices in the cart (custom Functions need Shopify Plus). There's no third-party product-page script or vendor dashboard that can inject code.
Talk to us about custom Shopify app development
Before you change anything: an App Risk Audit
Black Friday is November 27, and most stores freeze code a couple of weeks before. Our App Risk Audit maps every app on your store, identifies those that can run code from their dashboards, tests what breaks when each fails, and delivers a written fallback plan for each critical app.
Book an App Risk Audit before Black Friday
FAQ
Is Hulk Product Options safe now?
HulkApps says it removed the code, strengthened authentication, and hired an independent security firm. Shopify restored the theme extension. Check your settings, change your password, turn on 2FA, and test checkout.
Were other Hulk apps affected?
HulkApps says it found no evidence that any other Hulk app delivered a checkout redirect.
Can Shopify do product options without an app?
Partly. Variants, combined listings and line item properties cover many cases. Charging for non-variant add-ons needs an add-on product or custom checkout logic.
How did the attacker get into HulkApps?
HulkApps hasn't said. Possible routes include a compromised merchant or staff account, or a flaw in HulkApps' systems.
