Mysterious script injection adding broken GTM code and Cloudflare analytics to HTML

[mjohnson1]

What is the name of the domain?

Creator+Builder Labs | Your No-Code AI Journey to Digital Success

What is the error number?

No specific error number - script injection issue

What is the error message?

Failed to load resource: the server responded with a status of 404 (Not Found) /bcom/

What is the issue you’re encountering

My Cloudflare-hosted Next.js site is experiencing mysterious script injection that’s adding broken code to the HTML. Three unauthorized scripts are being injected: Broken GTM script with j.src=‘/bcom/’; (404 error) Google Tags First Party script with google_tags_first_party Cloudflare analytics script with token 485c775ac6824463bdc6a1cec2cd6b9f The injected scripts break Google Tag Manager in Chrome but Safari handles them gracefully. These scripts are NOT in my source code - confirmed by: Extensive VS Code searches for all script fragments GitHub Copilot analysis confirming scripts don’t exist in codebase Testing on localhost:3000 (isolated environment) still shows injection

What steps have you taken to resolve the issue?

1. Searched entire codebase for script fragments (/bcom/, developer_id.dYzg1YT, 485c775ac6824463bdc6a1cec2cd6b9f)
2. Verified source code contains only correct GTM implementation
3. Tested on localhost:3000 development server - scripts still inject
4. Tested in Safari vs Chrome - Safari works, Chrome fails
5. Used GitHub Copilot to analyze codebase - confirmed no broken scripts exist
6. Checked for browser extensions, malware, DNS issues
7. Deployed to Vercel as test - same scripts still appear (Cloudflare nameservers still active)

What are the steps to reproduce the issue?

1. Visit creatorbuilderlabs.com in Chrome
2. Open Developer Tools → Sources tab
3. View page source - observe three unauthorized scripts in
4. Check Console - see 404 error for /bcom/
5. Test window.google_tag_manager - returns undefined (broken)
6. Repeat in Safari - same scripts present but window.google_tag_manager works correctly

Expected behavior: Only my clean GTM script from layout.tsx should load
Actual behavior: Three mystery scripts inject, breaking GTM in Chrome

Screenshot of the error

[HenryB]

You have got google tag manager enabled.
The settings for it are in your account home, under tag management, Google tag manager, choose the correct domain.

[mjohnson1]

That isn’t it. Every setting under Tag Management is disabled.

[HenryB]

I cant reproduce the error here.
Only a single instance of GTM and no 404

On chrome, do you want to try it in an incognito window with all your extensions disabled.

[mjohnson1]

@HenryB

I cant reproduce the error here.
Only a single instance of GTM and no 404

OK, maybe it’s only on my side locally? Are you seeing two _ga cookies by chance?

[HenryB]

Just the one

[mjohnson1]

@HenryB

I cant reproduce the error here.
Only a single instance of GTM and no 404

OK, great. Thanks for your help. Looks like this is just a local issue and not a real problem.