it's look false positive. windows defender too lazy to check properly.

if you download javascript file have combinations of XMLHttpRequest or UNIX new line or web links, it will detected as malware or trojan.