I'm sure malicious code can be hidden in plain site anyway. Automated tools or human eyeballs won't spot it. For example here is the underhanded C contest demonstrating the principle with C http://underhanded.xcott.com/ (static analysis won't be possible on most JS code)

The only way to be sure is to implement a (bug free) sandbox that the code runs in, as then it won't matter what the code does.