The article is rather confusing than informative. JS is not the vector of attack. The server must have been attacked and compromised by other means and code must have been inserted into any of the files or templates served. Also, JS engines are quite safe by now, so the script could be used to track user activities on the affected page, but would probably not compromise the user's machine. (Also it could be used to inject any content exploiting a known or zero-day exploit of a plug-in like Reader, Flash Player, or Java, but this wouldn't be genuine to JS, but rather to any type of server-side injection.)