Why is ym-faux-ad-iframe being injected into my DOM? - google-chrome-extension

Question

I have a very basic skeleton React project set up.
Created using create-react-app using react-scripts-ts for typescript support. I have added on redux, and react-router. However, I just noticed that there is an iframe that is being injected into my DOM at some point and I cannot figure out why or where it is coming from.
It appears to be some sort of amazon ad iframe.
This is the request made by the browser
curl 'https://s3.amazonaws.com/ym-hosting/faux-ad.htm?advertiserId=78946&brandName=faux' -H 'Connection: keep-alive' -H 'Pragma: no-cache' -H 'Cache-Control: no-cache' -H 'Upgrade-Insecure-Requests: 1' -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8' -H 'Referer: http://localhost:3000/' -H 'Accept-Encoding: gzip, deflate, br' -H 'Accept-Language: en-US,en;q=0.9' --compressed
Installed Dependencies
"dependencies": {
"react": "^16.6.0",
"react-dom": "^16.6.0",
"react-redux": "^5.1.0",
"react-router-dom": "^4.3.1",
"react-scripts-ts": "3.1.0",
"redux": "^4.0.1",
"redux-logger": "^3.0.6",
"redux-thunk": "^2.3.0"
},
"devDependencies": {
"#types/jest": "^23.3.9",
"#types/node": "^10.12.2",
"#types/react": "^16.4.18",
"#types/react-dom": "^16.0.9",
"#types/react-redux": "^6.0.9",
"#types/react-router-dom": "^4.3.1",
"#types/redux": "^3.6.0",
"#types/redux-devtools-extension": "^2.13.2",
"#types/redux-logger": "^3.0.6",
"#types/redux-thunk": "^2.1.0",
"redux-devtools-extension": "^2.13.5",
"typescript": "^3.1.6"
},
Has anyone else seen anything like this before? Is some module quietly injecting this to cash in on easy ad views?
Screenshots:
Network Tools
DOM
EDIT: Turns out this has nothing to do with React or create-react-app but with a browser extension "HoverZoom".

Answer 1

I don't believe it's a React problem, I think it must be a browser extension injecting the iframe. I recently started developing a web app of my own (using F# on ASP.NET Core) and saw the same thing in my app's DOM just yesterday; your question was the only thing that came up when I googled around, so I thought to check other sites and everywhere I go seems to have it.
The iframe doesn't appear to be malicious at first glance (it's a faux ad for a Santa Fe getaway), but who knows if there's tracking code on the other end following our movements. Now to start disabling extensions until I find the culprit...
Edit: Appears to be Hover Zoom? Not sure if you use that one, but disabling it removed the iframe for me, so now it's gone forever.