E-commerce platform BigCommerce previously alerted its merchant community to a targeted security breach involving third-party applications developed by Ribon. The incident, which originated from compromised developer credentials, allowed attackers to inject malicious code directly into the storefronts of online retailers to facilitate credit card skimming.
The breach specifically targeted the “Storefront” layer of the merchant websites. By gaining access to the Ribon developer account, threat actors modified the JavaScript delivered by the apps. This method effectively bypassed core platform security measures because the malicious code was loaded as a trusted third-party integration that merchants had voluntarily installed.
The Mechanics of the Ribon Apps Compromise
The primary objective of the attack was a Magecart-style operation. Once the malicious JavaScript was injected into a store’s Script Manager, it would monitor the checkout process. When a customer entered their payment details, the script intercepted the data—including credit card numbers, CVVs, and expiration dates—and exfiltrated it to a server controlled by the attackers.
Research into the incident identified the specific malicious source as ribonapps[.]com/js/scripts.js. Because this script was hosted on the developer’s own domain, it appeared legitimate to many automated security scans that only looked for known blacklisted domains or drastic changes to the core BigCommerce infrastructure.
Several popular Ribon applications were identified as vectors for the malicious scripts, including:
- Ribon Rewards
- Free Shipping Bar
- Promotions & Discounts
- Product Labels
Platform Response and Mitigation
Following the discovery of the credential compromise, BigCommerce took action to protect affected storefronts. The platform removed the compromised Ribon applications from its official Marketplace and took the step of disabling the malicious scripts on behalf of the merchants. While BigCommerce acted to neutralize the immediate threat, the incident highlights a critical distinction in e-commerce security: the compromise was not a vulnerability in the BigCommerce core platform itself, but rather a failure at the third-party developer level.
Most Ribon applications have remained delisted since the incident was first reported in September 2021. For merchants concerned about legacy code or “orphaned” scripts, security experts recommend a manual audit of the BigCommerce Script Manager.
Steps for Verifying Store Integrity
Merchants who used Ribon applications in the past should verify that no residual code remains in their environments. Even if an app is uninstalled, it is possible for script references to persist if the removal process was interrupted or incomplete.
To verify store integrity, administrators should navigate to the Storefront > Script Manager section of the BigCommerce dashboard. Any entries referencing ribonapps.com should be removed immediately. Additionally, merchants should review their “Web Analytics” or “Footer” script sections for any unrecognized third-party JavaScript. If a store was active and using these apps during the period of compromise, a review of payment processing logs for unauthorized data access is standard practice for compliance and risk management.
