Prevent Spam Downloads on Safari
Wouldn't this be a good case for a Safari content blocker / javascript blocker that's selective?

Ghostery might be a good place to start on the Mac to see if you can use pre-built rules to quash cross-site scripting / ad injection of code into web pages. Of course, if the page is serving up that content directly you'll need to disable javascript on that page entirely or take note and just block those sites that crap up your experience intentionally or due to selling off ad injection to anyone with the means to afford this scare ware and scam ware.

If you wanted to be more precise - GreaseMonkey type user scrips could combat this with enough JS knowledge on your part (or finding someone that wrote the script to block today's iteration of this malware).


https://tampermonkey.net/?browser=safari
https://www.greasespot.net



  Edited By @JBis
  
  The following userscript was successfully in blocking the page. 

     // ==UserScript==
     // @name         The Bomb Squad
     // @version      0.1
     // @description  Blocks the pages containing any function with the bomb_ch function detailed in https://apple.stackexchange.com/questions/329594/prevent-spam-downloads-on-safari and https://blog.malwarebytes.com/malwarebytes-news/2018/02/tech-support-scammers-find-new-way-jam-google-chrome/
     // @author       Josh Brown (@JBis https://apple.stackexchange.com/users/263848/jbis)
     // @match        *
     // @grant        none

    // ==/UserScript==

   if (typeof bomb_ch === "function") {
     document.getElementsByTagName("body")[0].innerHTML="&lt;h1&gt;Page Defused by The Bomb Squad&lt;/h1&gt;&lt;p&gt;Because it contatained the following
 function(s):  &lt;pre&gt;bomb_ch()&lt;/pre&gt; &lt;br&gt;";
    }

  
  Note: Sp(c)ammers can easily bypass this by randomizing the bomb_ch() function.


Newer OS versions of Safari might help cut this down a bit, but there's money to be made by people that deliver this load of crap to your Mac so they'll likely adapt to any technologies that try to make it easy to block. Unless you're willing to spend more money supporting a business that maintains a library of settings that can "whack-a-mole" and adapt faster than the charlatans can cook up new code in their boiler room.

You'll also have to decide if the web sites that do this are also charlatans that are part of the con since they should know this is happening to you, one of the visitors they host.