First a little bit of background, About two weeks back one of the developers in my team said they were seeing advertisement popups and links appearing all over the web app we were developing, when they were running it on localhost. He is based in another country and I chalked this up to may be a network or machine local infection. They claimed that it went away after sometime but they weren't sure what they did to make it disappear though.
I did deploy the branch we were developing in yesterday, and one of the end users complained of the same thing, advertisement links and popups coming all over the place. When me and a few others tested it we didn't really see anything like that.
So my question is could some malicious javascript code have been injected into the source via the infected dev machine? That might be targeting some specific browser version? If so is there a way to detect it?
EDIT :
One of the original devs who ran into this told me that he tracked it down to google analytics. But I think it's more likely the analytics script was hijacked. Also many of his friends got effected as well, and the friend has no access to our web app. And the end user who got affected told he disabled a plugin he don't remember installing in chrome and it went back to normal. So the chance of this being a localised infection is high. But the coincident is bugging me. :-|