Highly obfuscated code would raise suspicions, especially in similar cases found in NPM packages.

E.g. in Python, obfuscators I've come across tend to replace characters with non-Latin unicode chars, which should raise flags when found in a predominatenly latin based source code.