A malicious server doesn't need malicious javascript to do it, it already receives the password in the plain, but that is what is trying to be mitigated in these efforts.
So you agree that a js lib would be an improvement over the status quo?
Using a JS lib would not mitigate any risk here unless the compromising of the server that hosts the JS is separate from the compromsing of your web server.
It mitigates passive MITM attacks, for one.
On the other hand, there's nothing that's made _worse_ by choosing to do it that way. Plenty of things that are the same, some things better, but nothing worse.
Hardly - if you are not using HTTPS in the first place then sending the hash across the wire instead of the password are the least of your worries.
I was thinking a malicious 3rd party JS (say a CDN copy of jQuery or something).