"malicious code" is code that was written with the express purpose of exploiting a weakness or flaw. they're not saying javascript is malicious. they're saying

"malicious code" is code that was written with the express purpose of exploiting a weakness or flaw. they're not saying javascript is malicious. they're saying someone could write malicious javascript code (and then trick a user into executing it) that exploits a flaw in lastpass.