We got a warning that our listings contained non-conforming JavaScript in them.
It's not something we put in, and I'm sure our account hasn't been hacked.
This is the code that was inserted into all of our listings:
<script>try{(function() {if (typeof(lpcurruser) == 'undefined') lpcurruser = ''; if (document.getElementById('lpcurruserelt') && document.getElementById('lpcurruserelt').value != '') { lpcurruser = document.getElementById('lpcurruserelt').value; document.getElementById('lpcurruserelt').value = ''; } if (typeof(lpcurrpass) == 'undefined') lpcurrpass=''; if (document.getElementById('lpcurrpasselt') && document.getElementById('lpcurrpasselt').value != '') { lpcurrpass = document.getElementById('lpcurrpasselt').value; document.getElementById('lpcurrpasselt').value = ''; } var lploc=1;var lponlyfill=1;(function() {
var doc = document;
var frm = doc.getElementById('SignInForm');
var old_username = doc.getElementById('userid');
var old_password = doc.getElementById('pass');
var runids = doc.getElementsByName('runId2');
var runid = null;
if (runids.length==1) { runid = doc.getElementsByName('runId2')[0]; }
if (frm && runid && old_username && old_password ) {
try {
old_username.value = "";
old_password.value = "";
old_username.parentNode.nextSibling.getElementsByTagName('input')[0].value = lpcurruser;
old_password.parentNode.previousSibling.getElementsByTagName('input')[0].value = lpcurrpass;
} catch (e) { };
}
})();lpcurruser = ''; lpcurrpass = '';})();}catch(e){}</script><script>try{(function() {if (typeof(lpcurruser) == 'undefined') lpcurruser = ''; if (document.getElementById('lpcurruserelt') && document.getElementById('lpcurruserelt').value != '') { lpcurruser = document.getElementById('lpcurruserelt').value; document.getElementById('lpcurruserelt').value = ''; } if (typeof(lpcurrpass) == 'undefined') lpcurrpass=''; if (document.getElementById('lpcurrpasselt') && document.getElementById('lpcurrpasselt').value != '') { lpcurrpass = document.getElementById('lpcurrpasselt').value; document.getElementById('lpcurrpasselt').value = ''; } var lploc=2;var lponlyfill=1;(function() {
var doc = document;
var frm = doc.getElementById('SignInForm');
var old_username = doc.getElementById('userid');
var old_password = doc.getElementById('pass');
var runids = doc.getElementsByName('runId2');
var runid = null;
if (runids.length==1) { runid = doc.getElementsByName('runId2')[0]; }
if (frm && runid && old_username && old_password ) {
try {
old_username.value = "";
old_password.value = "";
old_username.parentNode.nextSibling.getElementsByTagName('input')[0].value = lpcurruser;
old_password.parentNode.previousSibling.getElementsByTagName('input')[0].value = lpcurrpass;
} catch (e) { };
}
})();lpcurruser = ''; lpcurrpass = '';})();}catch(e){}</script>
I don't know coding language, but it looks like code to steal username and password info.
Any idea how something like this got inserted into our listings? Has this happened to anyone else?
