Not really sure how it could be malicious unless the intent is to simply break the oAuth flow on FFOS. JSON.parse is safe in terms of never evaluating JS?

In the case of poorly formatted responses I believe we have a try/catch situation around parsing.