I don't know if this instance I posted was someone trying to hack the javascript, or someone in a hurry at Auctiva trying to link to a file on their computer instead of on the server, but thought it best to alert Auctiva.
However, if you see my thread in the "Getting Started" forums, I posted a screenshot of my antivirus intercepting a trojan that the Auctiva site tried to download to my computer at 10:20am this morning.