There is kind of a reasonable expectation for sites to run JS on your computer, if you don't use NoScript. I'm more inclined to believe they installed an actual

There is kind of a reasonable expectation for sites to run JS on your computer, if you don't use NoScript. I'm more inclined to believe they installed an actual rootkit, though. There are vulnerabilities in image libraries all the time, and people who are just technically proficient enough to download the Tor Browser can be tricked into downloading .exe files.