The package exposes a class that needs to be instantiated and the resolved promise that returns the getRenderer method of this instance is what you need to use in your code to render JavaScript ...
API key exploitation is more than hypothetical. In a different context, a student who reportedly exposed a GCP API key on GitHub last June was left nursing a $55,444 bill (later waived by Google) ...