Oh, I should have taken a screenshot indeed, it’s not here anymore.
I checked within the code on github and nothing is calling the script, so I guess it was the hosting company or the CDN that injected it when I synced after every change (less than a minute sometimes). It happened for me in the past with free hosting that injected ads and tracking. I wrongly thought it was Publii because it’s nice and free, and I forgot about all the hops.
It’s not present anymore so it’s fine for me.
