I am in the process of packaging the new upstream version of plowshare. There has been a significant change so that the core framework (of shell scripts) is kept entirely separate to the scripts which use this API to implement support for specific external sites. Once this new version is available in the archives (it will have to go through the NEW queue because of the split into separate packages), I will be able to audit the code more carefully and isolate any javascript snippets. Hence I'll defer addressing this bug until the new package is ready.
signature.asc
Description: OpenPGP digital signature