Urgent: Need help removing malicious code injections (jsdeliver.cloud & brandAgents_js) from Shrine Theme

Technical Q&A
, , , ,
1

Hi everyone,

My store (BuroLipo, using Shrine Theme) was recently compromised by an unauthorized app called “Product Network.” While I have uninstalled the app, my site is still showing malicious script injections and phantom products from other stores.

The specific snippets I need to locate and safely remove are:

  1. References to shopify.jsdeliver.cloud (fake Shopify CDN).

  2. A block or script named brandAgents_js or frontendInjection.js.

  3. Unauthorized scripts originating from azurefd.net.

I am seeing these in my page source, but I am struggling to find the exact Liquid file or Snippet where these are being injected.

Technical Details:

  • Theme: Shrine

  • Issue: Cross-store product hijacking / Malicious JS injection.

Can someone guide me on where these scripts usually hide? Is it typically in theme.liquid, or should I be looking for specific .js assets or hidden snippets?

Any help would be greatly appreciated as this is affecting my checkout and store reputation. Thank you!

2

Share a preview password so we can see for ourselves.

Do you see these when do “View code” (then it’s rendered on the server) or when “Inspect elements” (then it can be added by another script).

If it’s in theme code, then you should be able to use global search in theme code editor to find these references:

Screenshot 2026-03-31 at 3.06.21 PM
Screenshot 2026-03-31 at 3.06.21 PM534×311 15.6 KB

4

Thank you for your insight. I want to clarify the situation:

I managed to capture the malicious behavior on my mobile device earlier. Although the issue is intermittent and hard to replicate now, I have saved the full page source from that session.

Here is what I found in the code during the hijacking:

  1. Cross-Store Injection: The source code contained numerous product links with -remote suffixes (e.g., /products/...-remote). These products belong to other stores like “Bisoulovely,” not mine.

  2. Malicious Domain: Shopify Support confirmed that the script loading from shopify.jsdeliver.cloud is a major Red Flag and is not a legitimate Shopify domain.

  3. Method of Injection: These scripts and products appeared in the “Inspect Elements” view during the incident. Since I have now uninstalled the “Product Network” app, I need to ensure there are no lingering Script Tags or hidden Liquid snippets that could trigger this again.

My preview password is zhenu2025. Even if the phantom products aren’t visible right now, could you please help me check if there are any suspicious ScriptTags or Web Pixels still registered in the background that might be calling that jsdeliver domain?

I want to make sure my store is 100% clean. Thank you!

5

frontendInjections seem to be a part of clarity (or masquerades as clarity?)

At the moment I do not see anything suspicious.
If you still see unexpected elements, can you share screenshots?

<!-- BEGIN app block: shopify://apps/microsoft-clarity/blocks/brandAgents_js/31c3d126-8116-4b4a-8ba1-baeda7c4aeea -->

<script type="text/javascript">
  (function(d){
      var s = d.createElement('script');
      s.async = true;
      s.src = "https://adsagentclientafd-b7hqhjdrf3fpeqh2.b01.azurefd.net/frontendInjection.js";
      var firstScript = d.getElementsByTagName('script')[0];
      firstScript.parentNode.insertBefore(s, firstScript);
  })(document);
</script>
<!-- END app block -->
6

Just restore files before that time, or restore an external backup if you have proper procedures in place.
https://help.shopify.com/en/manual/online-store/themes/theme-structure/extend/edit-theme-code#roll-back

Without burning the time to untangle this those seem like [remote products, a shopify feature] which(Remote products and multiple merchant in checkout changes - Announcements - Shopify Developer Community Forums) which is supposed to optional; meaning you the merchant enabled it especially if there was a full blown app installed it literally , third party apps have to be authorized by someone with access to your store so they aren’t “unauthorized” someone gave it permissions.

In which case if it is remote producents then nothing to see here but unneeded hysteria from not taking the time to understanding the platform your business relies on.
contact shopify support DIRECTLY to discuss it:
→ https://help.shopify.com

7

Ah, Paul I’ve seen several time an app go rogue and all of a sudden redirect people to other sites.
Nothing prevents an app from doing stuff on your storefront which is different from what you’ve authorized it to do.

8

None of this sounds suspicious to me. You haven’t said any malicious action was done, at all. Just because you say it’s malicious doesn’t mean it is. So, what is the problem here? Shopify Product Network, though I never heard of it before, is an app built by Shopify that puts or injects product blocks into your store (how safe could that be?). You Uninstalled the app, which means at some point you or someone who had access went into the app store and installed it. It didn’t magically sneak into your store. I can only imagine the kinds of crap people are installing. But you still haven’t said any bad happened… I see words hijacked and malicious but nothing that was actually done to make anyone think that’s what this is.

Azurefd.net is from Microsoft Azure, another app… and @tim_tairli pointed out the frontendInjection is from Clarity so that makes a lot of sense.

So it all just sounds like stuff you installed. If you wnt someone to come in and remove stuff, that’s one thing. But I see nothing malicious here.

9

Could also be a case like the old ones …

or this: