# US 2026/0095480 A1 · Method and system for protecting a checkout transaction from malicious code injection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2026/0095480 A1 - Document ID: US20260095480A1 - Status: Published application - Kind: A1 - Application number: 19/403,132 - Filed: 2025-11-27 - Published: 2026-04-02 - Earliest claimed: 2021-02-25 - Assignees: Shopify Inc. - Applicants: Shopify Inc. - Inventors: Jack McCracken; Peter Yaworski; Zachary Deveau - Web page: https://patentgrep.com/patent/US20260095480A1 ## CPC - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - G06F 21/563: {by source code analysis} - G06Q 20/4016: {involving fraud or risk level assessment in transaction processing} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract A computer-implemented method for detecting malicious code injection into checkout operations, the method including receiving a report regarding a checkout operation; determining based on the report that a checkout operation includes one or more events satisfying a first criterion; determining that a modification of customizable software code related to the checkout operation satisfies a second criterion; and responsive to the satisfaction of the first criterion and the second criterion, providing an indication of a detection of a potential malicious code injection into the checkout operation. ## Claims ### Claim 1 A computer-implemented method for detecting malicious code injection into checkout operations, the method comprising: receiving a Content Security Policy (CSP) report regarding a checkout operation; determining based on the report that the checkout operation satisfies a first criterion; determining that the checkout operation satisfies a second criterion; and responsive to the satisfaction of the first criterion and the second criterion, providing an indication of a detection of a potential malicious code injection into the checkout operation; wherein the first criterion comprises at least one of: a call to a Uniform Resource Locator (URL) on a list, a call string exceeding a threshold length, or a call string comprising sensitive information. ### Claim 2 (depends on 1) The method of claim 1, further comprising: responsive to the indication, triggering an action to mitigate the potential malicious code injection. ### Claim 3 (depends on 2) The method of claim 2, wherein the action includes a rollback of a code change associated with the potentially malicious code injection. ### Claim 4 (depends on 2) The method of claim 2, wherein the action includes locking a user account that made a code change associated with the potentially malicious code injection. ### Claim 5 (depends on 1) The method of claim 1, wherein the second criterion includes modification of customizable software code related to the checkout operation within a threshold time frame. ### Claim 6 (depends on 1) The method of claim 1, wherein the second criterion includes modification of customizable software code related to the checkout operation using an account that has not made modifications to the customizable software code file within a defined period. ### Claim 7 (depends on 1) The method of claim 1, wherein the second criterion includes modification of customizable software code related to the checkout operation from a new location. ### Claim 8 (depends on 1) The method of claim 1, wherein the second criterion includes modification of customizable software code related to the checkout operation using a new computing device. ### Claim 9 (depends on 2) The method of claim 2, further comprising establishing a confidence level that a malicious activity has occurred, and wherein the action is selected based on confidence level. ### Claim 10 (depends on 2) The method of claim 2, further comprising: analyzing a checkout operations file for malicious code segments prior to performing the action. ### Claim 11 (depends on 2) The method of claim 2, wherein the action comprises evaluating checkout operations for other shops. ### Claim 12 A computer system for detecting malicious code injection into checkout operations, the computer system comprising: a processor; and a communications subsystem, wherein the computer system is configured to: receive a Content Security Policy (CSP) report regarding a checkout operation; determine based on the report that the checkout operation satisfies a first criterion; determine that the checkout operation satisfies a second criterion; and responsive to the satisfaction of the first criterion and the second criterion, provide an indication of a detection of a potential malicious code injection into the checkout operation; wherein the first criterion comprises at least one of: a call to a Uniform Resource Locator (URL) on a list, a call string exceeding a threshold length, or a call string comprising sensitive information. ### Claim 13 (depends on 12) The computer system of claim 12, further configured to: responsive to the indication, trigger an action to mitigate the potential malicious code injection. ### Claim 14 (depends on 13) The computer system of claim 13, wherein the action includes a rollback of a code change associated with the potentially malicious code injection. ### Claim 15 (depends on 13) The computer system of claim 13, wherein the action includes locking a user account that made a code change associated with the potentially malicious code injection. ### Claim 16 (depends on 12) The computer system of claim 12, wherein the second criterion includes modification of customizable software code related to the checkout operation within a threshold time frame. ### Claim 17 (depends on 12) The computer system of claim 12, wherein the second criterion includes modification of customizable software code related to the checkout operation using an account that has not made modifications to the customizable software code file within a defined period. ### Claim 18 (depends on 12) The computer system of claim 12, wherein the second criterion includes modification of customizable software code related to the checkout operation from a new location. ### Claim 19 (depends on 12) The computer system of claim 12, wherein the second criterion includes modification of customizable software code related to the checkout operation using a new computing device. ### Claim 20 A non-transitory computer readable medium for storing instruction code for detecting malicious code injection into checkout operations, which, when executed by a processor of a computer system cause the computer system to: receive a Content Security Policy (CSP) report regarding a checkout operation; determine based on the report that the checkout operation satisfies a first criterion; determine that the checkout operation satisfies a second criterion; and responsive to the satisfaction of the first criterion and the second criterion, provide an indication of a detection of a potential malicious code injection into the checkout operation; wherein the first criterion comprises at least one of: a call to a Uniform Resource Locator (URL) on a list, a call string exceeding a threshold length, or a call string comprising sensitive information.