Correct, and notify the user the site is infected with a trojan with a scary warning screen. That second part being the bigger issue.
The JS being blocked isn't the issue, the fact I have users contacting me claiming the site was hacked was the big issue.
