If a user downloads a malicious JavaScript file, hackers can use it to gain access to their PC to steal data or perform other damaging functions.

Starting February 13, 2017, Google will not allow JS files to be sent as an attachment, including JS files detected within archives.