But I find it kind of ironic that a site that warns about malware wants JavaScript, just to display static content.
On the positive side, the JS code seems to be used only for loading custom fonts, and the website looks perfectly well without JavaScript using the standard system fonts.
But it does not explain why they need to use it.
<link href='//fonts.googleapis.com/css?family=PT+Sans|Signika:400,600' rel='stylesheet' type='text/css'>
<link href='//fonts.googleapis.com/css?family=Signika:300,700' rel='stylesheet' type='text/css'>
Moreover, they load a bunch of other JS libraries whose added value is practically non-existent (except maybe for their "email protection"):
<script type="text/rocketscript" data-rocketsrc="https://www.stopbadware.org/misc/jquery.once.js?v=1.2"></script>
<script type="text/rocketscript" data-rocketsrc="https://www.stopbadware.org/misc/drupal.js?ooq842"></script>
<script type="text/rocketscript" data-rocketsrc="https://www.stopbadware.org/sites/all/modules/jquery_update/replace/ui/external/jquery.cookie.js?v=67fb34f6a866c40d0570"></script>
...
<script type="text/rocketscript" data-rocketsrc="https://www.stopbadware.org/sites/all/libraries/superfish/sftouchscreen.js?ooq842"></script>
...
Your code example reminds me of what I just read on the StopBadware website:
> Some badware may not have malicious intentions, but still fails to put the user in control. Consider, for example, a browser toolbar that helps you shop online more effectively but does not mention that it will send a list of everything you buy online to the company that provides the toolbar.
Using hosted fonts so that they may be cached and CDN-served might not be bad, but the use of these has the effect of sharing everything you do online with Google.