In the height of tax-return season, a popular tax prep software service leaves a malicious JavaScript file online for weeks.