The concern here is that even after recovery from the compromise, the site could then <i>never</i> use the name &quot;parallax-plugin.js&quot; again, because a browser might have the cached malware under that name instead of the correct version.