widget.js is a 6,163-line, 260KB single file that every Stamped merchant loads on every page of their store.
It sometimes loads twice. We've observed this in the wild but the exact cause isn't fully diagnosed. There are at least two mechanisms that can inject it: the Shopify ScriptTag API (registered programmatically) and a manual <script> tag in theme.liquid. The code tries to detect duplicates before creating a new ScriptTag, but it never removes the other copy. There are runtime guards to prevent double-initialization, but by then the browser has already downloaded and parsed the full 107KB a second time. The guard is like locking the front door after the elephant is already in the living room.
It bundles jQuery 1.11 (2014 vintage). On load, it checks if the store already has jQuery. If not, it fetches it from Google's CDN as a blocking network request before anything else can happen. If the store does have jQuery, it hijacks th