Can't get rid of JavaScript appended to item descriptions. Hacked?

[jborn]

This morning I get an email from eBay instructing me to remove active content like JavaScript from my item descriptions. I never put JavaScript in my item descriptions, so I thought that was strange.

When I checked the item descriptions using the Revise option, there was a bunch of JavaScript contained in a script tag appended to the end of each item description. What is even weirded is every time I remove it, it is gone for maybe a minute, and then reappears again a few minutes later.

What is even sketchier is the JavaScript is attempted to access or create a log in form and get to a username and password.

I changed my eBay password right away, but the sketchy JavaScript keeps coming back.

It won't run, since eBay blocks JavaScript in item descriptions, but if I can't get rid of it eBay will remove my listings.

[eburtonlab · Accepted solution]

Are you using any third party listing tools like InkFrog? Or other programs like LastPass?

Those have been known to add extra code to listings at times.

Try copying a unique snippet of the included code and searching for it on the web -- see if others have encountered the same issue. You may be able to identify which extension or program is inserting it.

[jborn]

Good call. It turned out to be the LastPass browser extension.

https://community.ebay.com/t5/Archive-Selling/Code-appended-to-listing-description-bug-in-Ebay/td-p/...

[dwizkidd]

I have the same problem and found a work around.  This allows you keep last pass enabled when editing listings.

In your vault under the ebay entry, click on the wrench icon at the bottom to add a form field "v4-111txtEdit_ht" with the value set to blank.

This seems to have solved it for me in initial listing creation, and bulk editing tool.

It works because the name of the block for the "html" portion of the item description is "v4-111txtEdit_ht".  When you are on this page, it forces the lastpass add-on to substitute a blank value for this.

Let me us know if it works for you.

[dwizkidd]

Ok, this worked, but only for the listing I was editing.  The id (v4-111txtEdit_ht) changes based on the listing you are editing so this will not work for all.  I did find the solution on LastPass website but it requires eBay to change their page.  The need to add the following attribute to the element on the webpage where the javascript  is being added.  This will tell LastPass to ignore that field.

Any idea how to get this to eBay tech people?

[dwizkidd]

Ok, I think I have a work around now. I've tested in multiple listings and in the bulk listing editor and it seems to work.  I also logged out of eBay completely and was able to login using lastpass autofill.

1) Open your LastPass Vault.

2) Go to Account settings

3) Select "Never URLS"

4) Click "Add" button at bottom

5) Select Never Do Anything in the drop down box and fill in the URL as show in the pic That is bulksell (dot) ebay (dot) com -- eBay won't let me put url in the text here.

6) click Add and you will see the entry in the list.  It may take a few seconds for it to load back in.

IMPORTANT - IMPORTANT - IMPORTANT

7) Close all of your browser windows. Then start a new browser session. and it should work!

Please let us know if it works for you or if you have problems.

Thanks

Brian

[dwizkidd]

Ok, one more attempt.  The above fix seems to have stopped working (or my testing was flawed).  As of now (& this makes sense), edit your entry in last pass for eBay.  Set check mark in the 'Disable Autofill'  option.

This seems to be working.

Please let us know if any of these are working.

Thanks,

brian