Cloudflare described four malicious JavaScript operations, spanning eight payloads, that its Page Shield ML model flagged on live storefronts. The operations covered affiliate hijacking, clickless affiliate theft via an off-screen iframe, a remote code backdoor, and a mobile cloaker that disables nine monitoring tools. When Cloudflare later checked the payloads, seven of the eight were absent from VirusTotal and URLScan returned no malicious verdict for any of them.
Reputation scanners that judge a script by its hash or URL can miss client-side attacks that only reveal themselves through behaviour in live browser traffic. Cloudflare's graph neural network parses JavaScript as a syntax tree, so it can recognise suspicious call patterns across minification and renaming without relying on a known URL or byte signature. Scripts flagged by the GNN, under 0.3% of analyzed traffic, go to a lightweight LLM on Workers AI for a second opinion, and customers are alerted when both agree.
The four operations shared no common signature and stayed dormant until device, country, time, referrer, or browser state matched their conditions. One Lnkr payload version sat indexed by URLScan with no classification for nearly two and a half years. Teams running storefronts cannot treat a one-time dependency scan as proof that the scripts executing on their pages are safe.
The post is a vendor report and does not disclose an overall false-positive rate or how many benign scripts were flagged. A useful signal will be whether Cloudflare publishes precision figures for Page Shield ML alongside its reported detections.