All web sites, and ALL SCRIPT CODE, should be considered malicious until you test, or you choose to run regardless. Web site script code is the primary method for getting hacked. Safari includes basic code blocking. For Chrome (including Edge) and Firefox, consider "NoScript". With NoScript, uBlockOrigin, Ghostery and LeechBlock, the internet can be a calmer, quieter, safer place.