It is not about JS. Look into BadPDF as an example.

try your email with https://search.0t.rocks/ I checked mine and it did pop the Naz.API leak showing the first and last character of your password. Mine was leaked from Netflix

Has there ever been a Netflix breach (on public record anyway)? I'd be more wary that your machine was infected, from my experience naz.api logs are mostly from infected machines.

Which is a weird thing to see. I used Netflix on Apple TV or on a mac. The likelihood of a malware on the latter is low but nonetheless it was an old pass from few years back and I have stopped Netflix subscription long ago.

Interesting, I searched with my email and no Naz.API

I also found this. My email address/username/name doesn't appear at all in the 0t search.