Submitted per @sbassett.

Ok, a quick review:

1. In general, these kinds of user-scripts can become an especially ripe attack vector if they are 1) used by privileged users 2) are used by several users and loaded via one entry-point. The first case is certainly true, given the CU right required for queryCheckUserLog(). The second case isn't true so far as I'm only seeing one other user loading it, according to mwgrep. Still, something to be mindful of.
2. getStewards() - fine, only pulling public data via the API.
3. queryCheckUserLog() - fine, must have CU to view the CU log.
4. appendToPage() - fine by itself, if text is trusted/sanitized. See next items below...
5. getStatsTable() - even though we are pulling from a trusted source (mw API), it is a best practice to sanitize data at all sinks. Wrapping something like mw.html.escape() around entry.name and entry.count would be a good idea here.
6. init() - again, even though we are pulling from a trusted source (mw API), it is a best practice to sanitize data at all sinks. Wrapping something like mw.html.escape() around username and data within the onError handler would be a good idea. totalCount, within the $.when.apply block, should be fine since it's locally-derived from numerical data and is also being passed to jquery.text().

Thanks @sbassett - Do we have any steward who understands JS and can implement the recomendations? @hoo perhaps, or can we ask a trusted individual (@Daimona maybe?) to help us?

Proposed fixed version:

In T227221#5327291, @Legoktm wrote:

Proposed fixed version: P8739

Diff for the patch available.

The script does not work. Exception from the console:

URL: https://login.wikimedia.org/wiki/Special:BlankPage?debug=true

Uncaught TypeError: s.replace is not a function
    at Object.escape (mediawiki.base.js?528b7:525)
    at Object.<anonymous> (<anonymous>:56:32)
    at Function.each (jquery.js?6fb03:355)
    at getStatsTable (<anonymous>:53:7)
    at Array.<anonymous> (<anonymous>:106:27)
    at fire (jquery.js?6fb03:3269)
    at Object.fireWith [as resolveWith] (jquery.js?6fb03:3399)
    at jquery.js?6fb03:3782
    at fire (jquery.js?6fb03:3269)
    at Object.fireWith [as resolveWith] (jquery.js?6fb03:3399)

@MarcoAurelio - weird, it looks like javascript thinks some instances of username and/or cuCount are objects as opposed to strings. Clearly getStatsTable() is expecting them to always be strings. Here's a fix for getStatsTable() I came up with, tested here. It type-checks the data and then JSON.stringify()'s any unexpected data types.

function getStatsTable( entries ) {
	var html =
        '<table class="wikitable sortable">\n'
        + '<tr>'
        + '<th> Username </th>'
        + '<th> Count </th>'
        + '</tr>\n';

    $.each( entries, function( i, entry ) {
    	var name = (typeof entry.name == "string") ? entry.name : JSON.stringify(entry.name);
        var count = (typeof entry.count == "string") ? parseInt(entry.count).toString() :
            (typeof entry.count == "number") ? entry.count.toString() : JSON.stringify(entry.count);
    	
        html += '<tr>'
            + '<td>' + mw.html.escape( name ) + '</td>'
            + '<td>' + mw.html.escape( count ) + '</td>'
            + '</tr>\n';
    } );

    html += '</table>';

    return html;
}

Thanks @sbassett - I'll try to test this today.

@sbassett It works! Thanks!

Final version, with authorship attributed to all contributors: https://meta.wikimedia.org/wiki/User:MarcoAurelio/SVU.js

I might also port a copy to my GitHub account as well.

Upgraded: https://meta.wikimedia.org/w/index.php?title=User:Glaisher/countCUStats.js&diff=19200098&oldid=19197178