without going back and looking at the mega js, i recall it working as follows
password --> CBC-MAC --> master key --> decrypt RSA private key with derived master key
if you're deriving a key from a password, seems to make sense to use a password-based key derivation function.