esbuild-javascript-obfuscator 1.0.0

package/LICENSE

@@ -0,0 +1,7 @@
+Copyright 2026 Patchix
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -0,0 +1,7 @@
+# esbuild-javascript-obfuscator
+
+This project obfuscates your code using the javascript-obfuscator NPM package.
+
+This completely serves a plugin for esbuild.
+
+Licensed with MIT.

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+import { JSObfuscatorPlugin } from './plugin/plugin';
+export { JSObfuscatorPlugin };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/index.js

@@ -0,0 +1,2 @@
+import { JSObfuscatorPlugin } from './plugin/plugin';
+export { JSObfuscatorPlugin };

package/dist/logging.d.ts

@@ -0,0 +1,3 @@
+import type { JSObfuscatorOptions } from './types/JSObfuscatorOptions';
+export declare function CreateLogger(pluginOptions: JSObfuscatorOptions): (...data: any[]) => void;
+//# sourceMappingURL=logging.d.ts.map

package/dist/logging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.d.ts","sourceRoot":"","sources":["../src/logging.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,wBAAgB,YAAY,CAAC,aAAa,EAAE,mBAAmB,aAEhC,GAAG,EAAE,UAInC"}

package/dist/logging.js

@@ -0,0 +1,6 @@
+export function CreateLogger(pluginOptions) {
+    if (!pluginOptions.VerboseLogging) {
+        return function log(...data) { };
+    }
+    return console.log.bind(null, '[esbuild-javascript-obfuscator]');
+}

package/dist/plugin/optionValidator.d.ts

@@ -0,0 +1,8 @@
+import type { JSObfuscatorOptions } from '../types/JSObfuscatorOptions';
+/**
+ * Validates a given JSObfuscatorOptions object.
+ * @param options The options to validate
+ * @returns Array where first element is if it's OK or not, and the second being an optional message
+ */
+export declare function ValidateOptions(options: JSObfuscatorOptions): [boolean, string?];
+//# sourceMappingURL=optionValidator.d.ts.map

package/dist/plugin/optionValidator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"optionValidator.d.ts","sourceRoot":"","sources":["../../src/plugin/optionValidator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAWxE;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,mBAAmB,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CA+ChF"}

package/dist/plugin/optionValidator.js

@@ -0,0 +1,43 @@
+import assert from 'node:assert';
+/**
+ * Checks if a value is an object.
+ * @param value The value to check
+ * @returns True if the value is an object, false otherwise
+ */
+function IsObject(value) {
+    return typeof value === 'object' && value !== null;
+}
+/**
+ * Validates a given JSObfuscatorOptions object.
+ * @param options The options to validate
+ * @returns Array where first element is if it's OK or not, and the second being an optional message
+ */
+export function ValidateOptions(options) {
+    try {
+        /* Simple Type Checks */
+        assert(IsObject(options), 'Options must be an object');
+        // - VMProtection
+        assert(IsObject(options.VMProtection), 'VMProtection must be an object');
+        assert(typeof options.VMProtection.Enabled === 'boolean', 'VMProtection.Enabled must be a boolean');
+        if (options.VMProtection.Enabled) {
+            assert(typeof options.VMProtection.ApiKey === 'string', 'VMProtection.ApiKey must be a string when VMProtection.Enabled is true');
+        }
+        // - ObfuscatorOptions
+        assert(IsObject(options.ObfuscatorOptions), 'ObfuscatorOptions must be an object');
+        // - VerboseLogging
+        assert(typeof options.VerboseLogging === 'boolean', 'VerboseLogging must be a boolean');
+        // - ObfuscateAllFiles
+        if (options.ObfuscateAllFiles !== undefined) {
+            assert(typeof options.ObfuscateAllFiles === 'boolean', 'ObfuscateAllFiles must be a boolean if provided');
+        }
+        // - ObfuscateFilesWhitelist
+        if (options.ObfuscateFilesWhitelist !== undefined) {
+            assert(Array.isArray(options.ObfuscateFilesWhitelist), 'ObfuscateFilesWhitelist must be an array if provided');
+            assert(options.ObfuscateFilesWhitelist.every((file) => typeof file === 'string'), 'ObfuscateFilesWhitelist must be an array of strings if provided');
+        }
+    }
+    catch (err) {
+        return [false, `Assertion error: ${err.message}`];
+    }
+    return [true];
+}

package/dist/plugin/plugin.d.ts

@@ -0,0 +1,4 @@
+import * as esbuild from 'esbuild';
+import type { JSObfuscatorOptions } from '../types/JSObfuscatorOptions';
+export declare function JSObfuscatorPlugin(options: JSObfuscatorOptions): esbuild.Plugin;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/plugin/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/plugin/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAMnC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAwDxE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GA+DzD,OAAO,CAAC,MAAM,CACnB"}

package/dist/plugin/plugin.js

@@ -0,0 +1,86 @@
+import * as esbuild from 'esbuild';
+import * as JsObf from 'javascript-obfuscator';
+import fs from 'fs';
+import path from 'path';
+import { ValidateOptions } from './optionValidator';
+import { CreateLogger } from '../logging';
+async function ObfuscateFile(pluginOptions, finalized, file) {
+    const logger = CreateLogger(pluginOptions);
+    if (!file.path.endsWith('.js')) {
+        logger('file does not end with .js, skipping obfuscation: ', file.path);
+        return false;
+    }
+    if (pluginOptions.VMProtection.Enabled) {
+        const { ApiKey, Version } = pluginOptions.VMProtection;
+        logger('obfuscating with VM Protection ... ');
+        const proApiOptions = {
+            apiToken: ApiKey /* must exist because of optionValidator */,
+        };
+        if (Version) {
+            Reflect.set(proApiOptions, 'version', Version);
+        }
+        const obfuscateResult = await JsObf.obfuscatePro(new TextDecoder().decode(file.contents), pluginOptions.ObfuscatorOptions, proApiOptions, logger);
+        finalized.push({ fileName: file.path, outputCode: obfuscateResult.getObfuscatedCode().toString() });
+        logger('obfuscation with VM Protection completed for file: ', file.path);
+        return true;
+    }
+    logger('obfusacting with no VM protection...');
+    const obfuscateResult = JsObf.obfuscate(new TextDecoder().decode(file.contents), pluginOptions.ObfuscatorOptions);
+    finalized.push({ fileName: file.path, outputCode: obfuscateResult.getObfuscatedCode().toString() });
+    console.log(finalized);
+    logger('obfuscation completed for file: ', file.path);
+    return true;
+}
+export function JSObfuscatorPlugin(options) {
+    const log = CreateLogger(options);
+    const finalized = [];
+    log('JSObfuscatorPlugin initialized with options:', options);
+    const [isValid, errorMsg] = ValidateOptions(options);
+    log('isValid: ', isValid, ' errorMsg: ', errorMsg);
+    if (!isValid) {
+        throw new Error(`Invalid JSObfuscatorPlugin options: ${errorMsg || 'no error message provided'}`);
+    }
+    log('creating plugin');
+    const obfuscateFile = ObfuscateFile.bind(null, options, finalized);
+    return {
+        name: 'esbuild-javascript-obfuscator',
+        setup(build) {
+            if (build.initialOptions.write) {
+                throw new Error('esbuild-javascript-obfuscator plugin requires write: false in build options');
+            }
+            build.onEnd(async ({ errors, outputFiles }) => {
+                if (errors.length) {
+                    log('build completed with errors, skipping obfuscation (errors: %f)', errors.length);
+                    return;
+                }
+                if (!outputFiles) {
+                    log('No output files found, skipping obfuscation');
+                    return;
+                }
+                if (outputFiles.length > 1 && !options.ObfuscateAllFiles) {
+                    throw new Error('outputFiles.length > 1 but ObfuscateAllFiles not explicitly set');
+                }
+                if (outputFiles.length > 1 && options.ObfuscateAllFiles) {
+                    for (const file of outputFiles) {
+                        const success = await obfuscateFile(file);
+                        if (!success) {
+                            log('failed to obfuscate file: ', file.path);
+                        }
+                    }
+                }
+                else {
+                    const file = outputFiles[0];
+                    const success = await obfuscateFile(file);
+                    if (!success) {
+                        log('failed to obfuscate file: ', file.path);
+                    }
+                }
+                /* write pass */
+                for (const outputFile of finalized) {
+                    fs.mkdirSync(path.dirname(outputFile.fileName), { recursive: true });
+                    fs.writeFileSync(outputFile.fileName, outputFile.outputCode);
+                }
+            });
+        },
+    };
+}

package/dist/tests/optionValidator.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=optionValidator.test.d.ts.map

package/dist/tests/optionValidator.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"optionValidator.test.d.ts","sourceRoot":"","sources":["../../src/tests/optionValidator.test.ts"],"names":[],"mappings":""}

package/dist/tests/optionValidator.test.js

@@ -0,0 +1,93 @@
+import { test, expect } from 'bun:test';
+import { ValidateOptions } from '../plugin/optionValidator';
+const fakeObject = null;
+test('return false if not an object', () => {
+    const [isValid, errorMsg] = ValidateOptions(fakeObject);
+    expect(isValid).toBe(false);
+    expect(errorMsg).toContain('must be an object');
+});
+test('return false if VMProtection is not an object', () => {
+    const [isValid, errorMsg] = ValidateOptions({
+        VMProtection: null,
+        ObfuscatorOptions: {},
+        VerboseLogging: true,
+    });
+    expect(isValid).toBe(false);
+    expect(errorMsg).toContain('VMProtection must be an object');
+});
+test('return false if VMProtection.Enabled is not a boolean', () => {
+    const [isValid, errorMsg] = ValidateOptions({
+        VMProtection: { Enabled: {} },
+        ObfuscatorOptions: {},
+        VerboseLogging: true,
+    });
+    expect(isValid).toBe(false);
+    expect(errorMsg).toContain('VMProtection.Enabled must be a boolean');
+});
+test('return false if VMProtection.Enabled is true but ApiKey is not a string', () => {
+    const [isValid, errorMsg] = ValidateOptions({
+        VMProtection: { Enabled: true, ApiKey: 123 },
+        ObfuscatorOptions: {},
+        VerboseLogging: true,
+    });
+    expect(isValid).toBe(false);
+    expect(errorMsg).toContain('VMProtection.ApiKey must be a string when VMProtection.Enabled is true');
+});
+test('return false if ObfuscatorOptions is not an object', () => {
+    const [isValid, errorMsg] = ValidateOptions({
+        VMProtection: { Enabled: false },
+        ObfuscatorOptions: null,
+        VerboseLogging: true,
+    });
+    expect(isValid).toBe(false);
+    expect(errorMsg).toContain('ObfuscatorOptions must be an object');
+});
+test('return false if VerboseLogging is not a boolean', () => {
+    const [isValid, errorMsg] = ValidateOptions({
+        VMProtection: { Enabled: false },
+        ObfuscatorOptions: {},
+        VerboseLogging: 'true',
+    });
+    expect(isValid).toBe(false);
+    expect(errorMsg).toContain('VerboseLogging must be a boolean');
+});
+test('return false if ObfuscateAllFiles is provided but not a boolean', () => {
+    const [isValid, errorMsg] = ValidateOptions({
+        VMProtection: { Enabled: false },
+        ObfuscatorOptions: {},
+        VerboseLogging: true,
+        ObfuscateAllFiles: 'true',
+    });
+    expect(isValid).toBe(false);
+    expect(errorMsg).toContain('ObfuscateAllFiles must be a boolean if provided');
+});
+test('return false if ObfuscateFilesWhitelist is provided but not an array', () => {
+    const [isValid, errorMsg] = ValidateOptions({
+        VMProtection: { Enabled: false },
+        ObfuscatorOptions: {},
+        VerboseLogging: true,
+        ObfuscateFilesWhitelist: 'file.js',
+    });
+    expect(isValid).toBe(false);
+    expect(errorMsg).toContain('ObfuscateFilesWhitelist must be an array if provided');
+});
+test('return false if ObfuscateFilesWhitelist is provided but not an array of strings', () => {
+    const [isValid, errorMsg] = ValidateOptions({
+        VMProtection: { Enabled: false },
+        ObfuscatorOptions: {},
+        VerboseLogging: true,
+        ObfuscateFilesWhitelist: ['file.js', 123],
+    });
+    expect(isValid).toBe(false);
+    expect(errorMsg).toContain('ObfuscateFilesWhitelist must be an array of strings');
+});
+test('return true if all options are valid', () => {
+    const [isValid, errorMsg] = ValidateOptions({
+        VMProtection: { Enabled: false },
+        ObfuscatorOptions: {},
+        VerboseLogging: true,
+        ObfuscateAllFiles: true,
+    });
+    expect(isValid).toBe(true);
+    expect(errorMsg).toBeUndefined();
+});

package/dist/tests/plugin.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=plugin.test.d.ts.map

package/dist/tests/plugin.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.test.d.ts","sourceRoot":"","sources":["../../src/tests/plugin.test.ts"],"names":[],"mappings":""}

package/dist/tests/plugin.test.js

@@ -0,0 +1,50 @@
+import { test, expect } from 'bun:test';
+import esbuild from 'esbuild';
+import fs from 'fs';
+import path from 'path';
+import { JSObfuscatorPlugin } from '../plugin/plugin';
+const ObfuscationOptions = {
+    VMProtection: {
+        Enabled: false,
+    },
+    ObfuscatorOptions: {
+        compact: true,
+        stringArray: true,
+    },
+    VerboseLogging: false,
+    ObfuscateAllFiles: false,
+};
+function CreateDummyFiles() {
+    fs.mkdirSync(path.join(__dirname, 'temp'));
+    fs.writeFileSync(path.join(__dirname, 'temp', 'index.ts'), `
+        console.log("Hello World")
+        `);
+    return function cleanup() {
+        fs.rmSync(path.join(__dirname, 'temp'), { recursive: true, force: true });
+    };
+}
+test('plugin should throw error when write: true', async () => {
+    const cleanup = CreateDummyFiles();
+    expect(esbuild.build({
+        entryPoints: [path.join(__dirname, 'temp', 'index.ts')],
+        bundle: true,
+        write: true,
+        minify: true,
+        plugins: [JSObfuscatorPlugin(ObfuscationOptions)],
+    })).rejects.toThrow(`esbuild-javascript-obfuscator plugin requires write: false in build options`);
+    cleanup();
+});
+test('plugin should successfully obfuscate a single file', async () => {
+    const cleanup = CreateDummyFiles();
+    await esbuild.build({
+        entryPoints: [path.join(__dirname, 'temp', 'index.ts')],
+        bundle: true,
+        outfile: path.join(__dirname, 'temp', 'out.js'),
+        write: false,
+        minify: true,
+        plugins: [JSObfuscatorPlugin(ObfuscationOptions)],
+    });
+    const obfuscatedCode = fs.readFileSync(path.join(__dirname, 'temp', 'out.js'), 'utf-8');
+    cleanup();
+    expect(obfuscatedCode).toContain('parseInt');
+});

package/dist/types/JSObfuscatorOptions.d.ts

@@ -0,0 +1,51 @@
+import JsObf from 'javascript-obfuscator';
+export interface JSObfuscatorOptions {
+    /**
+     * The options for VM protection. If Enabled is true, ApiKey must be provided.
+     */
+    VMProtection: {
+        /**
+         * Whether you would like to enable VM protection or not. (requires subscription)
+         */
+        Enabled: boolean;
+        /**
+         * The API key from your obfuscator.io dashboard. Visit API Keys link to get your API key.
+         *
+         * This must be provided if VMProtection.Enabled is true.
+         *
+         * Links:
+         * - [API Keys](https://obfuscator.io/dashboard/settings/api-keys)
+         */
+        ApiKey?: string;
+        /**
+         * The version of the VM protection to use. If not provided, the latest version will be used.
+         */
+        Version?: string;
+    };
+    /**
+     * The options for the JavaScript obfuscator.
+     *
+     * You can go to the dashboard, press the braces button (to the left of the preset option) and export the options as JSON and paste it here (requires subscription).
+     *
+     * Links:
+     * - [Dashboard](https://obfuscator.io/dashboard)
+     */
+    ObfuscatorOptions: JsObf.ObfuscatorOptions;
+    /**
+     * Whether you would like to enable verbose logging or not.
+     */
+    VerboseLogging: boolean;
+    /**
+     * Whether you would like to obfuscate every single output file (provided it is .js).
+     *
+     * If this is not explicitly provided and there are multiple output files, the plugin will error.
+     */
+    ObfuscateAllFiles?: boolean;
+    /**
+     * An optional whitelist of files to obfuscate.
+     *
+     * This must be provided if `ObfuscateAllFiles` is truthy and must be an array of filenames.
+     */
+    ObfuscateFilesWhitelist?: string[];
+}
+//# sourceMappingURL=JSObfuscatorOptions.d.ts.map

package/dist/types/JSObfuscatorOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"JSObfuscatorOptions.d.ts","sourceRoot":"","sources":["../../src/types/JSObfuscatorOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,uBAAuB,CAAC;AAE1C,MAAM,WAAW,mBAAmB;IACnC;;OAEG;IACH,YAAY,EAAE;QACb;;WAEG;QACH,OAAO,EAAE,OAAO,CAAC;QAEjB;;;;;;;WAOG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;QAEhB;;WAEG;QACH,OAAO,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IAEF;;;;;;;OAOG;IACH,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,CAAC;IAE3C;;OAEG;IACH,cAAc,EAAE,OAAO,CAAC;IAExB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;CACnC"}

package/dist/types/JSObfuscatorOptions.js

@@ -0,0 +1 @@
+import JsObf from 'javascript-obfuscator';

package/package.json

@@ -0,0 +1,41 @@
+{
+	"name": "esbuild-javascript-obfuscator",
+	"version": "1.0.0",
+	"description": "An esbuild plugin to obfuscate JavaScript code.",
+	"author": {
+		"name": "Patchix"
+	},
+	"license": "MIT",
+	"keywords": [
+		"esbuild",
+		"esbuild-plugin",
+		"javascript-obfuscator",
+		"obfuscator"
+	],
+	"type": "module",
+	"main": "./dist/index.js",
+	"module": "./dist/index.js",
+	"types": "./dist/index.d.ts",
+	"files": [
+		"dist"
+	],
+	"scripts": {
+		"clean": "rm -rf dist",
+		"build:js": "bun build ./src/index.ts --outdir ./dist --target node",
+		"build:types": "tsc",
+		"build": "bun run clean && bun run build:js && bun run build:types",
+		"prettier": "prettier --write .",
+		"prepublishOnly": "bun run build"
+	},
+	"dependencies": {
+		"esbuild": "^0.28.1",
+		"javascript-obfuscator": "^5.4.5"
+	},
+	"devDependencies": {
+		"@types/bun": "latest",
+		"prettier": "^3.9.4"
+	},
+	"peerDependencies": {
+		"typescript": "^5"
+	}
+}