Posted on 09-28-2017 10:28 AM
https://www.wearesegment.com/research/Mac-OS-X-Local-Javascript-Quarantine-Bypass.html
Of course the file is protected by SIP, so removal is not so simple.
Posted on 09-28-2017 01:00 PM
Looks like the fix for it is in High Sierra, but not rolled back to previous OSes, not even 10.11. Great.