Some cross-site scripting in usernames there, otherwise its a fun concept.

Edit: To the author the fix is pretty small:

In socket.on('toplist', (data) => {...})

Replace the line:

    $('#toplist tr:last').after('<tr>' +'<td>' + topList[i].name + '</td>' + '<td>' + topList[i].points + '</td>'+ '</tr>');

with:

    $('#toplist tr:last').after($("<tr></tr>").append($("<td></td>").text(topList[i].name),$("<td></td>").text(topList[i].points)))