You can't really inspect the source of most modern JS web apps without deobfuscation tools. Similar tools exist to disassemble WASM binaries and turn them into something readable.

Specifically for finding crypto miners, web requests will be an obvious sign of something fishy happening. You can see everything in the network inspector and if the binary uses some kind of additional encryption of requests, you should assume it's malicious.