[herge]

If the javascript comes from your computer (because it's embedded in the page you self-host), how could it get compromised?