[hueving]

Same thing as compromising one of these packages loaded from a CDN...

If someone loads a bad JS library, it doesn't matter where it came from.