Seems related to shopify, at least all spammed pages have this in common:

/cdn/shop/t/2/assets/ <script type="importmap"> @theme/*