Related question: can source maps be manipulated to hide malicious code? Source maps weren't really designed with an adversarial threat model in mind.