I'm not defending anyone here but just strace the program if you're really worried about it. If you don't know what strace is: it exports every syscall the program has made, so you'd see if it's doing anything suspicious.

Careful with the sarcasm. Only positive vibes are allowed on showHN or the admin goes ballistic. I've seen it happen.

What could go wrong? It is static site and there is no backend, so the key is only in the browser.