Deployment hygiene
You protect a bundle, ship it, and a customer’s antivirus or corporate EDR quarantines it as “suspicious.” Nothing is wrong with your code — the scanner is matching on shape, not intent. Real malware has leaned on obfuscation for years to hide its payloads, so heuristic engines learned to treat the techniques as a signal. Legitimate protection and malware use some of the same moves, so the same alarm can fire on both. The good news: the specific shapes that draw the most heat are avoidable, and a few deployment habits make protected code sail through.
Why the alarm fires
Antivirus and EDR products score files with heuristics — statistical and pattern rules, not proof of malice. The patterns that overlap between obfuscation and malware:
eval / new Function on a decoded string. The classic “unpack a blob and execute it” loader is the single strongest malware tell. Old eval-based packers do exactly this — and so does a lot of malware.- Long, high-entropy string arrays and hex/base64 blobs. Big walls of encoded data look like a hidden payload to an entropy heuristic, whether it’s a decryptor table or a smuggled executable.
- Heavy control-flow flattening and dead code. Deliberately confusing structure is what sandbox-evasion malware also does to dodge analysis.
- Inline scripts inside HTML. Obfuscated JavaScript embedded directly in a page is a common drive-by-download shape, so inline blobs get extra scrutiny versus external files.
- Known-signature collisions. Occasionally a byte sequence in your output coincidentally matches a signature for a specific known-bad sample.
None of these prove anything — that’s why it’s a false positive — but the scanner errs toward blocking.
How to ship protected code that doesn’t get quarantined
- Avoid
eval and new Function. This is the biggest single win. Modern obfuscation — string-array decoding, control-flow flattening, VM bytecode — is ordinary code that runs without runtime code-generation. That’s also why it’s compatible with strict CSP. If your tool’s output contains a decrypt-then-eval loader, that’s the first thing to drop.
- Serve as external
.js files, not inline. External bundles delivered over HTTPS with correct Content-Type are treated far more calmly than obfuscated blobs pasted inline in HTML. It also keeps your CSP strict.
- Don’t over-protect. Maxing every transform on the whole bundle raises entropy and structural weirdness — exactly the heuristic triggers — while also hurting performance. Target strong protection at the sensitive functions and keep the rest light. Less blanket obfuscation means fewer alarms.
- Sign and version your builds. For desktop/Electron or extension contexts, code-signing certificates and a consistent publisher reputation dramatically reduce false positives — reputation systems trust signed, established publishers. Build provenance and signed attestations help here too.
- Keep behavior transparent where it’s reviewed. Don’t obfuscate in ways that hide what the code does from a reviewer who’s allowed to see it — that’s the exact thing store review and EDR are trying to catch. Protect proprietary logic, not the fact that your app makes network calls.
If it still gets flagged
False positives happen even to clean, signed builds. When one does: capture which engine flagged it and the detection name, scan the file on a multi-engine service to see if it’s one vendor or many, and submit a false-positive report to that vendor — every major AV company has a form, and legitimate signed software is usually cleared quickly. If a single engine is an outlier, it’s almost always a heuristic misfire rather than a real signature. Keep a record of your build provenance so you can show the file is yours.
The short version
Obfuscated JavaScript gets flagged because malware pioneered the same techniques, so scanners react to the shape. The fix is to avoid the shapes that scream “malware” — no eval-based loaders, no giant inline blobs, no blanket max-everything — serve external signed files, and report the occasional false positive. Do that and strong protection and clean AV scans stop being a trade-off.