DebugBear Asks Customers to Remove Monitoring Script

DebugBear has advised customers to remove its Core Web Vitals monitoring script after attackers hijacked the company’s DNS and used it to serve malicious JavaScript, Search Engine Journal reported.

The request puts a routine measurement tool on the list of items site owners need to review. DebugBear’s script monitors Core Web Vitals, the website performance measures used by marketers and web teams to assess user experience. The immediate action reported is to remove the script rather than continue using it while treating the incident as solely a vendor issue.

Site owners should also check accounts that may have been exposed and look for changes they did not authorize. Those reviews address a different question from the script removal: whether there are account or website changes that need attention. Removing the monitoring code alone does not establish whether an account was affected or whether a site was changed.

For teams managing websites, the practical work may involve both marketing and technical staff. Marketers can identify where the monitoring script is used and coordinate its removal with the people responsible for site code. The account and change checks can then be handled by whoever administers access and maintains the website. Keeping those tasks distinct can help teams track what has been reviewed and what still needs attention.

The incident also shows why third-party measurement code deserves a place in a site’s operational records. Knowing which scripts are installed, where they appear and who can change them makes it easier to act on a vendor’s instructions. An account review should likewise focus on identifying access or changes that the site owner cannot account for, rather than assuming that the presence or absence of the script resolves every question.

The reported guidance does not establish that every DebugBear customer experienced an account compromise or an unauthorized site change. Each owner’s review should determine what, if anything, requires follow-up on their own accounts and websites.

What this means for marketers

Ask the team responsible for your website to remove the DebugBear monitoring script, check potentially exposed accounts and review unauthorized changes. Record who is handling each task so that the script removal and the account checks are both completed.