Talos: obfuscated JavaScript is phishing kit plumbing, and beautifiers will not read it for you

Beautifying is where most triage stops, and it is the step that produces the most false confidence. Prettier and Biome will restore indentation and line breaks, but according to the Talos post they cannot restore original variable names, recover intent, rebuild removed structure, decode runtime strings, or turn a dispatcher loop back into normal logic ^[10]. An analyst who opens a formatted file and writes "obfuscated, probably malicious" in the ticket has described the wrapper and nothing else.

Look at the six questions Talos says are worth asking: what does it read, what does it write, where does it connect, what code does it generate, what conditions change its behavior, and what happens to a real user, developer or build runner ^[8]. All six ask about behavior rather than syntax ^[17]. That is the whole problem in one list. Packing reconstructs the real code at runtime ^[9], and Talos notes that `eval()` is indifferent to whether its input began as readable JavaScript, Base64, gzip output or a custom string table ^[13]. The only reliable reading of the artifact is the one the decoder produces itself, which is why the recommended move is to find the unpacking step, replace the execution sink, log the payload, decode the next layer and continue ^[14]. Layers, not a single trick: the post's framing is that obfuscation is smaller tricks stacked until the behavior disappears under ceremony ^[15], grouped into buckets such as hiding strings and identifiers and hiding which APIs are in use ^[19].

Doing that safely is an infrastructure line item. Talos says to assume the sample is hostile, work on a copy, and keep unknown JavaScript away from your normal machine, your normal browser profile, and anything holding credentials, clipboard contents, SSH agents, npm tokens, cloud credentials or corporate proxy details ^[5]. Two of those details are worth reading together with the rest of the post. npm package install scripts appear on the list of suspicious uses ^[11], and build runners appear in the diagnostic questions ^[8], so the guidance assumes some readers are analysing hostile scripts from inside a development environment ^[18], which is exactly where a clean throwaway profile is hardest to keep.

The internal tension is around tooling. The author says the workflow leans on AI assistance, then says those tools are not a sandbox and not an evidence source by themselves, and should see only isolated snippets, decoded artifacts and payloads you are comfortable sharing ^[6][7]. In practice that ranks the sink-replacement work above the explanation: whatever a model says a sample does, the destinations and conditions still have to be observed.

One more restraint worth crediting. Talos does not treat obfuscation as a verdict, listing bundling, minification, IP protection and anti-tamper controls as legitimate reasons for it ^[12]. And the material carries no counts, percentages or named campaigns ^[16] to support the "party trick to phishing kit" arc ^[1] beyond the author's own caseload of phishing kits, malware packages and compromised sites ^[4].