Import can only read valid code, and even if malicious content is embedded, Unity just reads it with JsonUtility.FromJson<SongData>(), so it won't be executed like JavaScript. However, there is a ...

I made it so the camera follows along. At first, I set it to the same coordinates as the player, which made the screen go blank, but I learned that the camera needs a Z-coordinate (depth).