deobfuscate-javascript

SUSPICIOUS: the core deobfuscation behavior is coherent with the skill’s purpose, and most file access is proportionate. The main risk comes from executing or installing third-party CLIs at runtime and from autonomous self-modification/commit instructions; these are not clearly malicious, but they expand trust and execution scope enough to merit caution.

This module is a deobfuscation/unpacking tool whose core functionality includes dynamic evaluation (new Function) of attacker-derived content for both Packer argument-list parsing and AAEncode decoding unless explicitly disabled via --no-eval. While it does not itself demonstrate network exfiltration or persistence, it is a high-risk utility to run on untrusted inputs because it can execute arbitrary JavaScript in-process and can output decoded code to stdout or to an arbitrary file path.

This module is overwhelmingly consistent with a supply-chain malware loader/dropper pattern: it heavily obfuscates and reconstructs an executable JavaScript payload at runtime, retrieves a Function/constructor-like execution primitive via computed property access, and immediately executes the assembled payload string. Even though the snippet does not reveal the runtime payload’s exact actions, the presence of dynamic evaluation via a constructor-like sink with constructed source code makes the security risk critical.

This snippet is a highly obfuscated eval-based self-decoder. In the shown fragment, the decoded effect appears limited to assigning a constant (42) and calling console.log(42), with no visible data theft or system compromise. However, the use of runtime code generation and obfuscation is inherently risky and warrants review of the surrounding package/context to ensure this is not a loader for more harmful behavior.