3 ms·

Same thing as compromising one of these packages loaded from a CDN... If someone loads a bad JS library, it doesn't matter where it came from.