I'm not 100% sure I understand your issue, but you should definitely assume that it is possible for the password to be read by other JS running on the same page.