New JavaScript obfuscation technique: Formatting a script can turn it into a different program

This security news reports on a novel JavaScript obfuscation approach where applying formatting, minification, or deobfuscation processes to a script can cause it to execute as a different program. The technique involves 186 distinct methods to achieve this divergence, allowing a single script to morph into multiple behaviors depending on how it is processed. Demonstrations and technical breakdowns are available on the referenced websites, illustrating the concept and its implications for code analysis and security tooling.

The impact is primarily on code analysis, reverse engineering, and security tooling that rely on formatting or deobfuscation to understand JavaScript code. This technique can potentially evade detection or cause misinterpretation of script behavior by automated tools. However, there is no direct evidence of active exploitation or vulnerabilities in software products. The technique may complicate threat detection and forensic analysis but does not itself constitute a software vulnerability.

No direct remediation or patch is applicable as this is a research demonstration of a code obfuscation technique rather than a software vulnerability. Security practitioners should be aware of this technique's potential to evade static analysis and consider enhancing dynamic analysis or behavioral detection methods. No vendor advisory or official fix is available or required.