> how can one make malicious code with JavaScript run in a browser?
JavaScript is a programming language, so of course it's possible to do something malicious with it. You can only limit the capabilities of a language so much before you start hindering its usefulness.
Fingerprinting is the most prominent example. Much of the Tor Browser Bundle's countermeasures against fingerprinting involve blocking certain JavaScript functionalities.
Also, JavaScript can be used to implement digital restriction mechanisms in various ways. I've encountered one example: a certain website I used to visit does things to stop people from using ad blockers. It does this by deleting the page's content if an ad blocker is detected. Recently, it went even further by requiring use of JavaScript to access the page, making the restriction mechanism more effective. I'm sure there are other examples of digital restriction mechanisms implemented with JavaScript.
I think I've heard somewhere that JavaScript is also used somehow to infect Windows machines with malware, but I never investigated that one and don't know if it's true.
> Even if a web JavaScript is licensed as free software, that in no way insures it's secure and non-malicious.
That's exactly why LibreJS's approach of license tags doesn't provide any meaningful guarantees. ;)
> As I browse the web most things I see done with JavaScript are very trivial and specific to that site. It doesn't seem useful to put everything in repository because there are too many scripts and most of them are very specific to one website.
I agree it's a lot of work, but so is convincing every Web developer to start conforming to LibreJS's license tags. And besides, this way it would be possible to actually replace proprietary scripts ourselves.
By the way, if a script truly is trivial (like setting an attribute, or perhaps whatever LibreJS defines as "trivial"), then the browser should have a setting that allows all of these scripts to just be executed. But most websites don't only use such trivial code.
> Non-trivial JavaScript code is used mostly in sites which offer SaaSS and those shouldn't be used anyway.
You mean like Diaspora, Friendica, YouTube, Google Maps, Quitter (GNU Social), and Reddit?
I don't know, none of these are SaaSS, and I don't think all the JavaScript on these sites is trivial.
