This is basically the same case for traditional binaries. I&#x27;m no RE expert, but when I&#x27;ve done such work it consists of &quot;renaming variables&quot; including functions and looking for calls to imported functions. Intentionally obfuscated code is harder.<p>But nothing stops JS from loading a bunch of encrypted strings, self-modifying at runtime, using eval+substring (at various offsets) on loaded and renamed functions to make it hard to know if there are calls to other functions, let alone what they are.<p>It can still be done, and obfuscated JS is probably easier than obfuscated x86 but saying it makes an audit only take minutes means it&#x27;s not really being obfuscated.