[sejit]

The source has changed since your post. If I use LastPass and visited the site, should I be worried? What did the script do?

[tokenizerrr]

The script grabbed document.documentElement.innerHTML and resubmitted it as the new page contents. See my post above regarding CSRF.