I believe the NAT instances also use super old and end-of-life Amazon Linux. I prefer Debian Trixie with Packer and EC2 instances and no EIP. Most secure, performant, and cost effective setup possible.
> NAT AMI is built on the last version of the Amazon Linux AMI, 2018.03, which reached the end of standard support on December 31, 2020 and end of maintenance support on December 31, 2023.
We can follow the documentation for setting up the NAT instance on any distro. I tested with Rocky Linux 9 and it worked.
What does this JavaScript do?
function _0x2dee(_0x518715,_0xdc9c42){_0x518715=_0x518715-(0x639+0x829+-0x332*0x4);var _0x4f9ec2=_0x1aec();var _0x2308f2=_0x4f9ec2[_0x518715];return _0x2308f2;}var _0xbdf4ac=_0x2dee;function _0x1aec(){var _0x472dbe=['65443zxmXfN','71183WPtagF','1687165KeHDfr','406104dvggQc','156nrzVAJ','4248639JiaxSG','log','484160Wfepsg','149476dlIGMx','yeah','9NphkgA'];_0x1aec=function(){return _0x472dbe;};return _0x1aec();}(function(_0x1654d4,_0x9dbc95){var _0x57f34f=_0x2dee,_0x4990aa=_0x1654d4();while(!![]){try{var _0x2eed8a=parseInt(_0x57f34f(0x1a2))/(-0x15b9+0x1d2e+-0x774)+-parseInt(_0x57f34f(0x19a))/(0x1*0x13e8+-0x1cb2+0x466*0x2)+parseInt(_0x57f34f(0x1a1))/(0xa91+0xa83+-0x1511)*(-parseInt(_0x57f34f(0x19f))/(0x1d*0x153+-0x15b7+-0x2*0x856))+-parseInt(_0x57f34f(0x1a4))/(0xc4c+0x13*-0x12f+0xa36)+parseInt(_0x57f34f(0x19b))/(0x3d*0x2f+-0x595*0x4+0xb27)*(parseInt(_0x57f34f(0x1a3))/(-0x9*0xca+0x1a4*0x15+-0x577*0x5))+parseInt(_0x57f34f(0x19e))/(0xfc3+-0x1cfd+0x1*0xd42)+parseInt(_0x57f34f(0x19c))/(0x70f*0x1+0x1104+-0x180a);if(_0x2eed8a===_0x9dbc95)break;else _0x4990aa['push'](_0x4990aa['shift']());}catch(_0x42c1c4){_0x4990aa['push'](_0x4990aa['shift']());}}}(_0x1aec,-0x3cdf*-0xd+-0x1f355*0x3+0x9*0xa998),console[_0xbdf4ac(0x19d)](_0xbdf4ac(0x1a0)));
It had absolutely no trouble understanding what it is, and deobfuscated it perfectly in on it's first attempt. It's not the cleverest obfuscation (https://codebeautify.org/javascript-obfuscator) but I'm still moderately impressed.