Three popular plugins served malicious JavaScript through a compromised CDN.
The comments on some Steam Profiles are actually loaded with invisible malware.