Background: it is not difficult to introduce vulnerabilities in backend/API code when not coding with security in mind. This typically leads to vulnerabilities such as XSS or various injections (or others).
It is also possible that this backend/API code is intentionally written as malicious - this is something I put on the side, concentrating on the first case.
Vulnerabilities which lead to server-side issues (XSS, ...) are not in scope, I am wondering about a scenario where the attack would be made possible because of flaws in JS code per se.
In contrast, I know how to use malicious JS code to steal information from the DOM (in the case of, for instance, some widget portal where the JS code running is not vetted). This is not the case I am interested in.