Any known vulnerabilities?

JFBConnect has never had a known, published security vulnerability. We are always looking on ways to improve and secure our code, but there haven't been any issues we've uncovered within the last year (and likely even longer) that we've needed to address.

I don't think the issue you're running into is with JFBConnect at all. If the tag is only showing up with the no-script extension, that means the hacked code is specifically looking for search engines which don't run Javascript normally. That's a standard way to evade detection as only the search engine will see the malicious code whereas everyone else with a real browser sees the normal page.

Unfortunately, I don't have many good answers on where to go next. If your site already has malicious code, just updating extensions won't fix things.. even if you happen to close the original hole that was used to access your file-system. You'll need to narrow down when the hack occurred, restore a backup to before that point, then update everything to close the hole. The other option is to re-build your site from the ground up from a clear filesystem, though you can usually keep the database from the live site so contents aren't lost.

I'd highly recommend contacting your hosting provider as most can run security scans to detect holes, out of date/insecure products and find where some malicious code may be hiding.

I hope that helps,
Alex

No problem. I'm glad it's not our extension, but also wish I could give you a magic bullet to solve it. Hackers suck.

Good luck,
Alex