Skip to content

Instantly share code, notes, and snippets.

@lorishui

lorishui/javascript-deobfuscation-red-flags.md

Created July 21, 2026 02:19
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save lorishui/696bd23056faffce1ed29b8c798c33ae to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save lorishui/696bd23056faffce1ed29b8c798c33ae to your computer and use it in GitHub Desktop.
Download ZIP
JavaScript deobfuscation red flags
Raw
javascript-deobfuscation-red-flags.md

JavaScript Deobfuscation Red Flags

Reference tool: JavaScript deobfuscation red flags

When reviewing obfuscated JavaScript, prioritize these red flags after decoding and beautifying the snippet:

  • Dynamic execution: eval, new Function, timer strings.
  • Hidden strings: hex, Unicode, octal, and base64-like values.
  • Dynamic property access: window[decodedName], document[method].
  • Suspicious network calls: unknown URLs, webhook endpoints, tracking pixels.
  • DOM injection: innerHTML, document.write, script element creation.
  • Environment checks: browser, extension, locale, or debugger detection.

Static deobfuscation does not prove code is safe. It just makes the first review pass less awful.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment