Honestly the location tracking stuff is debatable, but the JS loaded from some random person's GitHub account? That's the real issue imo. Compromise that one account and you've got arbitrary code execution inside an app the White House ships. I've seen this happen at work too -- someone copy-pastes a CDN link during a sprint and it just... never gets revisited. The fix is so simple (vendor it, pin a hash, at least use an org account) which kinda makes it worse. Reminds me of the event-stream thing all over again.