Yeah I saw them but didn't quite understand the ones at the bottom e.g."eval". I get the weird type conversions at the top, not how they magically become function calls at the bottom.

Edit: Wikipedia article explains - you can call functions by name with that "filter" thing.

This should be pretty easily blockable though - if you block "eval" then just block most of the obscure jsfuck constructs too.

the jsfuck.js parses the obfuscated string to generate valid javascript code. One one the patterns that jsfuck.js supports is "run the followin as eval()" https://github.com/aemkei/jsfuck/blob/master/jsfuck.js line 282