You can clone the repo, audit the code, then host it yourself if you want to: https://github.com/electronicwhisper/recursive-drawing/tree/...

If you're worried about someone MITM'ing you and injecting malicious code on random webpages you should be using a VPN.

Unless your local network or ISP is particularly bad VPNs only make it worse IMHO.

Yes, and you can trust your ISP and/or VPN and you have no way to tell if the origin web server is compromised and is serving malicious JS. HTTPS or not.