Simple Bundles is not affected by the script injection attacks on Shopify apps (October 2026)

Simple Bundles is not affected by the malicious script injection attacks on Shopify apps reported in October 2026. Simple Bundles does not load scripts from its own database onto your storefront, so the way these attacks reached shoppers does not apply to it. You don't need to change anything in Simple Bundles.

Last reviewed: October 22, 2026

What happened?

In mid-October 2026, attackers placed malicious JavaScript into storefronts through some third-party Shopify apps. Shopify removed several of the affected apps from the App Store. Scripts like these can change what shoppers see on a store, for example sending them to a fake checkout page to collect their payment details.

Why isn't Simple Bundles affected?

• The Simple Bundles code that runs on your storefront is packaged as a Shopify theme app extension and released through Shopify. It is not loaded from our database.
• Bundle settings you save in the app, such as option names and bundle contents, are stored and shown as plain data. They are never run as code on your storefront.
• Simple Bundles has no setting for adding custom JavaScript inside the app. Any custom code for your bundles lives in your Shopify theme, which only you and the staff or collaborators you approve can edit.
• Bundle upsells at checkout use Shopify's checkout UI extensions. These run inside Shopify's sandbox and cannot read payment details.

Do I need to do anything?

Not for Simple Bundles. With the holiday season close, it is still a good time to check your store's overall security:

• Turn on two-step authentication for every staff account.
• Remove apps you no longer use.
• Review staff and collaborator accounts in Settings > Users and remove anyone who no longer needs access.
• Be careful about installing new apps with few reviews right before a busy sales period.

Where can I see other security updates?

The Simple Bundles security center lists every security issue we have reviewed and whether Simple Bundles is affected.

I noticed something strange on my storefront. What should I do?

Email hello@simplebundles.io with screenshots and your store's myshopify.com URL. If it involves Simple Bundles, our development team will look into it right away.