This is effectively a supply chain attack. To defend against it you need to secure the supply chain all the way from build to deployment.
So a quick solution would be to run a job that checks your site every minute or so and compares the javascript against known hash values. Shut the site down if a hash has changed.
So a quick solution would be to run a job that checks your site every minute or so and compares the javascript against known hash values. Shut the site down if a hash has changed.