I don't have anything interesting to add, but the infection was via advertisements it looks like. Until now my stance has been "I use an ad blocker generally, it's too much work to turn off for individual sites" while feeling bad about hurting non-abusive sites that relied on advertising to operate (YouTube?).

This made me realize though that there is no conscionable argument to ask people to disable ad blockers on your site, and I no longer feel bad about not disabling them. If you ask people to disable ad blockers, you are asking them to expose themselves to increased risk and you have a moral obligation to find an alternate way to fund operation (maybe there are human-vetted, js-free first-party served advertising networks...).