A nice trick to detect this kind of malicious codes is to double click it. When you double click some of this types of hidden codes, the selectable part will become highlighted I might show something that looks just plain wrong. For example, here are 2 cases related to the same article:
In this case, I double clicked the ls part. I would assume as a normal user that it would have highlighted the whole line, but instead did the above. This shows that ls and the rest of the line of code is NOT on the same HTML element, giving you a hint that there is something wrong with the HTML. It could be wrong tag or malicious intent.
In this one, you can see the highlighted part keeps on going to the right and although, in this case if you paste the copy code to gedit it will show the correct information, this is another way of using the malicious code. The code could be hidden to the right and by double clicking it, even if you do not see it, the highlighted part would still take it (For example, changing the menu on the right to a z-index value higher than the rest and to top it off, a position that makes sure everything looks "good".
In neither of this cases, double clicking the code gave you the actual line. I want to also add that if you double click and it selects the whole line, like in the second example, it might not be a bad thing in some sites. The site could have handled the selected area as the whole line instead of selecting only the text as the following example illustrates:
As you can see, I double clicked on the command but it highlighted the whole line. Yes, there could be some evil code behind this, but since the site is trusted, it lowers the chance of this happening (Still, to make sure, paste the content to a text editor).
What it actually should NOT do a select half of the code then do what the first image I posted did which is to jump to the bottom of the page for no "appearing reason" instead of selecting the whole line where it is.