Reference: static JavaScript deobfuscation tool
Do not execute suspicious snippets just to understand them. A safer first pass is static text transformation:
- Decode escapes.
- Beautify structure.
- Rename obvious helper variables in your notes.
- Inspect strings, URLs, and dynamic execution points.
- Only run code later in a sandbox if absolutely necessary.