Malicious storefront scripts can hide until the right visitor arrives

Cloudflare describes four malicious JavaScript operations found on storefronts that still appeared to work normally. Some scripts waited for particular devices, times or browser state before intercepting clicks or sending hidden affiliate requests. Its detection pipeline examines code structure and asks a language model for a second opinion, illustrating why a single clean page scan can miss conditional behaviour.

Cloudflare Blog · Sep 16, 2026

Why it matters

Frontend security reviews need to account for third-party scripts and delayed execution.

More context

This September catch-up covers the detection method and affiliate-hijacking examples. Try reviewing which scripts and tag managers can execute on your own storefront, then test relevant browser states rather than relying on one snapshot.

Keep in mind

Cloudflare reports selected detections for its own product, not an independent comparative benchmark. Hidden affiliate requests do not by themselves prove that commissions were paid or stolen.

Original read