Cove Wishlist

What to look for in a wishlist app after the Swym incident

Published 2026-10-20. Facts about Swym checked 2026-10-20.

In October 2026 Swym paused its Wishlist Plus app for every merchant after someone tried to put malicious code on merchants’ storefronts through it. We make a competing wishlist app, so weigh what follows accordingly. We have kept to what Swym and others have published, said where they differ, and listed what nobody has said yet.

What Swym has said

From Swym’s FAQ (dated 2026-10-20):

• Swym’s team detected unauthorized activity “over the past week”, in which attempts were made to add malicious code to merchant storefronts through the Wishlist Plus app, to redirect shoppers away from those stores.
• Swym says it identified the activity immediately and paused the app for all merchants at once, impacted or not, to stop it spreading. It revoked Shopify access for Wishlist Plus and its other apps, so the app does not open in Shopify admin, and wishlist and alert emails have stopped.
• It rotated all app credentials. It says pausing does not delete wishlist data and that it will give a timeline for restoring access “in due course”.
• Its investigation so far found no evidence that merchant data or customer personal information was compromised within or through the app. It adds that on stores where the malicious code ran, a shopper’s details may have been compromised if they typed them into the external site.
• It names one malicious domain, checkout-guard[.]top, and three more it has seen in similar attacks, and tells merchants to search their theme files for them and to turn off the Swym app embeds. Our migration guide walks through those steps.

A second account of the timeline, with a caveat

Independent researcher Roman Zipp has been tracking the wider wave of checkout redirects. In a post of company statements he summarises a Swym statement that is not on Swym’s FAQ page and that we could not find on a Swym page: a configuration change made by an unauthorized party on 14 October, between about 10:06 and 11:56 UTC, caused a script to load on a limited subset of storefronts; fixes rolled out from 15:02 and were fully deployed by 16:32 UTC; shoppers who clicked checkout on affected pages may have been redirected to a site built to imitate a checkout; Swym says it does not collect or store card data. These are his summary of a statement, not Swym’s words, and that summary also says the embed was safe to re-enable, which is not what the FAQ says. Where they differ, follow Swym’s FAQ and status page.

What nobody has said yet

• Root cause. Swym’s FAQ says it is “investigating how this happened”.
• How many stores. Neither Swym nor Zipp gives a number. Swym says it has contacted impacted merchants directly.
• When the app returns. No date has been given.
• Whether the incidents are linked. Zipp wrote on 19 October that he cannot yet conclude anything.

It wasn’t only one app

Per Zipp’s tracking and the company statements he collects, several Shopify apps were hit in the same weeks, by different routes:

• Hulk Product Options: Zipp found the code in a field (custom_js) of a response from the app’s own API, which the app’s storefront script ran in the shopper’s browser. It was not a theme edit.
• Selleasy: its statement says an unauthorized party used an internal tool to add a script to the Custom JS setting of a number of stores.
• Qikify: in an earlier incident (July, resolved in August, not part of the October wave per the company) code was put into two HTML content fields in the app’s settings, with nothing written to merchants’ themes.
• Swym: an “unauthorized change to the app’s configuration”, in the statement as Zipp summarises it.

The common thread in what is published is not a stolen theme file. It is that these apps had a place on their own side, such as a config entry, a custom-code field or an API response, whose contents ended up running on merchants’ storefronts, and someone who got into that place could reach every store that used it. Reading across four incidents like this is our inference, and the companies have not said it.

Seven questions for any wishlist app

1. Where does the code on my storefront come from? Ideal: only from the app’s theme extension, which ships through Shopify review and versioning. Worrying: scripts or HTML fetched from the vendor’s servers each time a page loads.
2. Can a setting turn into running code? Look for “custom JS”, “custom HTML” or similar fields, and ask who can change them, from where, and whether changes are logged and reviewed.
3. Which scopes does it request? The install screen lists them. write_themes, write_script_tags and write_online_store_pages let an app change your store’s code. A wishlist rarely needs any of them.
4. What personal data does it keep? Data that isn’t stored can’t leak. Ask whether shoppers’ emails and names are copied or only IDs are kept.
5. Can I get my data out without the vendor’s admin? Right now Swym’s admin is closed and its FAQ does not say how to export. Ask for a documented export, and test it before you need it.
6. What happens when something goes wrong? Look for a written commitment on notice time, a pause-and-rotate-credentials step, and a published postmortem. Compare it with what you see in a live incident: dated, specific, indicators included.
7. Who can reach production? Hardware-key two-factor on every account with access, logged access, no shared logins.

How Cove is built

We designed Cove around those questions, and you can check the first three on the install screen and in the theme editor:

• Storefront JavaScript ships only inside the versioned theme app extension. Our servers return JSON, never scripts or HTML, and the code doesn’t use eval or innerHTML.
• Your design is rendered by Liquid from a metafield the app owns; the storefront script never fetches design or settings.
• No theme write access: we never request write_themes, write_script_tags or write_online_store_pages. The only write scope is write_app_proxy, which routes your store’s /apps/wishlist address to the app and can’t change store data or code. A test fails the build if the scope list changes.
• We store Shopify IDs, not shoppers’ names or emails. Emails in an import file are used in memory to match customers and never saved.

If you’re on Swym now

Switch off Swym’s app embeds, check your theme files, and get your wishlist data out before you decide anything else. The step-by-step guide covers all three and how to import into Cove. The export, embed and theme steps apply whichever app you move to.

Sources

1. Wishlist Plus Security Precaution: Frequently Asked Questions (Swym)
2. Swym service status (Swym)
3. Statements from Companies involved in Shopify Checkout Hijack (Roman Zipp (independent researcher))
4. Shopify shops hit with ongoing Checkout Hijack attack (Roman Zipp (independent researcher))

Spotted a mistake or something out of date? Email contact@stackcraftdigital.co.uk and we’ll fix it and note the correction here.