It's fair to say that JavaScript-the-language is not intrinsically vulnerable to this, but how else are you planning on delivering the JavaScript to clients? I may be misinterpreting your goals.