Use require.js instead of the script trick.
Restrict question type string to be a valid C identifier. This should prevent any arbitrary code execution.
This doesn't use eval directly. Requirejs does, but I hope they use it safetly.