As others have observed, if the attackers had wanted, they could have modified the hosted jQuery scripts and used them to attack other web sites. They don't seem to have done so, but this highlights how the practice of including scripts hosted by other parties is a security problem for the Internet as a whole.
But there's an easy way to fix it. Browsers should support a hash attribute for <script> tags, so instead of
But there's an easy way to fix it. Browsers should support a hash attribute for <script> tags, so instead of
sites could instead say This would also significantly reduce the risks from use of http instead of https, and from weaknesses in https itself.