simple-javascript-obf 0.1.1

package/.github/workflows/node.js.yml

@@ -0,0 +1,31 @@
+# This workflow will do a clean installation of node dependencies, cache/restore them, build the source code and run tests across different versions of node
+# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-nodejs
+
+name: Node.js CI
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        node-version: [18.x, 20.x, 22.x]
+        # See supported Node.js release schedule at https://nodejs.org/en/about/releases/
+
+    steps:
+    - uses: actions/checkout@v4
+    - name: Use Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ matrix.node-version }}
+        cache: 'npm'
+    - run: npm ci
+    - run: npm run build --if-present
+    - run: npm test

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 js-obf contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,92 @@
+# js-obf
+
+A modular JavaScript obfuscation CLI with control-flow flattening (CFF) and optional VM virtualization.
+
+## Features
+- CLI input/output for Node.js and browser-targeted bundles
+- AST-level obfuscation: variable renaming, string encryption (Base64 + custom stream cipher / polymorphic variants), dead-code injection, control-flow flattening
+- Always runs Terser compression on output
+- Optional VM virtualization (covers common syntax; see limitations)
+- Optional anti-hook runtime guard (detects tampering of common built-ins)
+- VM opcode mapping randomization and mask obfuscation, fake opcode injection (configurable via `vm.opcodeShuffle` / `vm.fakeOpcodes`)
+- VM bytecode runtime decryption (can be disabled via `vm.bytecodeEncrypt`)
+- VM const pool runtime decryption (can be disabled via `vm.constsEncrypt`)
+- Highly modular plugin architecture for easy extension
+
+## Install
+```
+npm install
+```
+
+## Usage
+```
+node bin/js-obf input.js -o output.js --preset high --vm --seed my-seed
+```
+
+Supports stdin (use `-` as input):
+```
+cat input.js | node bin/js-obf - -o output.js
+```
+
+### Interactive script
+Use the interactive script to choose features and specify input file/directory and output directory:
+```
+bash bin/obf.sh
+```
+If an input directory is provided, it will recursively obfuscate all `.js` files and overwrite them, automatically ignoring `node_modules` (also tolerates common misspellings of that directory name).
+
+## CLI options
+- `-o, --output <file>` Output file
+- `--preset <high|balanced|low>` Preset strength (default `high`)
+- `--no-rename` Disable variable renaming
+- `--no-strings` Disable string encryption
+- `--no-cff` Disable control-flow flattening
+- `--no-dead` Disable dead-code injection
+- `--vm` Enable VM virtualization (see limitations)
+- `--vm-include name1,name2` Only virtualize the specified function names
+- `--vm-opcode-shuffle` Enable VM opcode random mapping (default on)
+- `--no-vm-opcode-shuffle` Disable VM opcode random mapping
+- `--vm-fake-opcodes <0-1>` Fake opcode injection probability (default 0.15)
+- `--vm-bytecode` Enable VM bytecode runtime decryption (default on)
+- `--no-vm-bytecode` Disable VM bytecode runtime decryption
+- `--vm-consts` Enable VM const pool runtime decryption (default on)
+- `--no-vm-consts` Disable VM const pool runtime decryption
+- `--vm-downlevel` Allow VM to downlevel `let/const` to `var`
+- `--anti-hook` Enable anti-hook runtime guard
+- `--anti-hook-lock` Enable anti-hook and freeze built-in prototype chains
+- `--seed <value>` PRNG seed
+- `--ecma <version>` Terser output ECMAScript version (default 2015)
+- `--sourcemap` Emit source map
+- `--compact` Compact output
+
+Default output is ES2015 to preserve `let/const`. For ES5, set `--ecma 5`.
+
+## VM virtualization coverage
+VM supports most common syntax while keeping performance and memory overhead reasonable:
+- Control flow: `if/else`, `for/while/do-while`, `switch`, `break/continue`
+- Exceptions: `try/catch/finally` (supports `throw`)
+- `async/await` (only inside `async` functions)
+- Variables: `var` (`let/const` are skipped by default; use `--vm-downlevel` to force)
+- Parameters: defaults, rest params, parameter destructuring (object/array)
+- Expressions: literals, member access, function calls, object/array literals, `new`, template strings, etc.
+
+### VM limitations
+- Generator function bodies are not virtualized (functions containing `yield` are skipped, but you can declare generators inside normal functions)
+- Optional chaining / nullish coalescing (`?.` / `??`) not supported
+- `spread` (call/array/object) and object rest destructuring not supported
+- Destructuring assignment expressions are not supported (only parameter/variable declaration destructuring)
+- Complex or unsupported nodes are skipped for that function
+- VM uses the `Function` constructor to create closures; CSP-restricted environments may not run
+
+## Structure
+- `src/index.js`: core API
+- `src/pipeline.js`: plugin pipeline
+- `src/plugins/*`: obfuscation plugins
+- `src/utils/*`: utilities and RNG
+- `bin/js-obf`: CLI entry
+
+## License
+MIT License. See `LICENSE`.
+
+## Third-Party Notices
+Some dependencies require preserving author and license notices. See `THIRD_PARTY_NOTICES.md`.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,82 @@
+# Third-Party Notices
+
+This project depends on third-party packages that require preservation of
+copyright notices and license terms. The following notices are provided to
+comply with those requirements.
+
+## Babel packages (@babel/generator, @babel/traverse, @babel/types)
+
+MIT License
+
+Copyright (c) 2014-present Sebastian McKenzie and other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+## @babel/parser
+
+Copyright (C) 2012-2014 by various contributors (see AUTHORS)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+## terser
+
+Copyright 2012-2018 (c) Mihai Bazon <mihai.bazon@gmail.com>
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+* Redistributions of source code must retain the above
+  copyright notice, this list of conditions and the following
+  disclaimer.
+
+* Redistributions in binary form must reproduce the above
+  copyright notice, this list of conditions and the following
+  disclaimer in the documentation and/or other materials
+  provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER “AS IS” AND ANY
+EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
+LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.

package/bin/js-obf

@@ -0,0 +1,228 @@
+#!/usr/bin/env node
+
+const fs = require("fs");
+const path = require("path");
+const { obfuscate } = require("../src/index");
+
+function printHelp() {
+  const text = `
+Usage:
+  js-obf <input.js | -> [options]
+
+Options:
+  -o, --output <file>        Output file
+  --preset <high|balanced|low>  Preset strength (default: high)
+  --no-rename                Disable identifier renaming
+  --no-strings               Disable string encoding
+  --no-cff                   Disable control flow flattening
+  --no-dead                  Disable dead code injection
+  --vm                       Enable VM virtualization (see README limits)
+  --vm-include <a,b,c>        Only virtualize specified function names
+  --vm-opcode-shuffle        Enable VM opcode shuffle (default: on)
+  --no-vm-opcode-shuffle     Disable VM opcode shuffle
+  --vm-fake-opcodes <0-1>    Fake opcode insertion probability (default: 0.15)
+  --vm-bytecode              Encrypt VM bytecode at runtime (default: on)
+  --no-vm-bytecode           Disable VM bytecode encryption
+  --vm-consts                Encrypt VM const pool at runtime (default: on)
+  --no-vm-consts             Disable VM const pool encryption
+  --vm-downlevel             Allow VM to downlevel let/const to var
+  --anti-hook                Enable anti-hook runtime guard
+  --anti-hook-lock           Freeze built-in prototypes after guard
+  --seed <value>              RNG seed
+  --ecma <version>           Terser output ECMAScript version (default: 2015)
+  --sourcemap                Emit source map
+  --compact                  Compact output
+  -h, --help                 Show help
+`;
+  process.stdout.write(text);
+}
+
+function parseArgs(argv) {
+  const args = argv.slice(2);
+  const options = {
+    preset: "high",
+  };
+  const positional = [];
+
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === "-h" || arg === "--help") {
+      options.help = true;
+      continue;
+    }
+    if (arg === "-o" || arg === "--output") {
+      options.output = args[i + 1];
+      i += 1;
+      continue;
+    }
+    if (arg === "--preset") {
+      options.preset = args[i + 1] || "high";
+      i += 1;
+      continue;
+    }
+    if (arg === "--seed") {
+      options.seed = args[i + 1];
+      i += 1;
+      continue;
+    }
+    if (arg === "--ecma") {
+      options.ecma = args[i + 1];
+      i += 1;
+      continue;
+    }
+    if (arg === "--sourcemap") {
+      options.sourcemap = true;
+      continue;
+    }
+    if (arg === "--compact") {
+      options.compact = true;
+      continue;
+    }
+    if (arg === "--vm") {
+      options.vm = true;
+      continue;
+    }
+    if (arg === "--vm-include") {
+      options.vmInclude = (args[i + 1] || "").split(",").filter(Boolean);
+      i += 1;
+      continue;
+    }
+    if (arg === "--vm-opcode-shuffle") {
+      options.vmOpcodeShuffle = true;
+      continue;
+    }
+    if (arg === "--no-vm-opcode-shuffle") {
+      options.vmOpcodeShuffle = false;
+      continue;
+    }
+    if (arg === "--vm-fake-opcodes") {
+      options.vmFakeOpcodes = args[i + 1];
+      i += 1;
+      continue;
+    }
+    if (arg === "--vm-bytecode") {
+      options.vmBytecode = true;
+      continue;
+    }
+    if (arg === "--no-vm-bytecode") {
+      options.vmBytecode = false;
+      continue;
+    }
+    if (arg === "--vm-consts") {
+      options.vmConsts = true;
+      continue;
+    }
+    if (arg === "--no-vm-consts") {
+      options.vmConsts = false;
+      continue;
+    }
+    if (arg === "--vm-downlevel") {
+      options.vmDownlevel = true;
+      continue;
+    }
+    if (arg === "--no-rename") {
+      options.rename = false;
+      continue;
+    }
+    if (arg === "--no-strings") {
+      options.strings = false;
+      continue;
+    }
+    if (arg === "--no-cff") {
+      options.cff = false;
+      continue;
+    }
+    if (arg === "--no-dead") {
+      options.dead = false;
+      continue;
+    }
+    if (arg === "--anti-hook") {
+      options.antiHook = true;
+      continue;
+    }
+    if (arg === "--anti-hook-lock") {
+      options.antiHook = true;
+      options.antiHookLock = true;
+      continue;
+    }
+    positional.push(arg);
+  }
+
+  return { options, positional };
+}
+
+function readInput(file) {
+  if (!file || file === "-") {
+    return fs.readFileSync(0, "utf8");
+  }
+  return fs.readFileSync(file, "utf8");
+}
+
+function writeOutput(file, code) {
+  if (!file) {
+    process.stdout.write(code);
+    return;
+  }
+  fs.writeFileSync(file, code, "utf8");
+}
+
+async function main() {
+  const { options, positional } = parseArgs(process.argv);
+  if (options.help || positional.length === 0) {
+    printHelp();
+    process.exit(options.help ? 0 : 1);
+  }
+
+  const inputPath = positional[0];
+  const source = readInput(inputPath);
+  const outputPath = options.output
+    ? options.output
+    : inputPath === "-"
+      ? null
+      : path.join(
+          path.dirname(inputPath),
+          `${path.basename(inputPath, path.extname(inputPath))}.obf.js`
+        );
+
+  const result = await obfuscate(source, {
+    preset: options.preset,
+    rename: options.rename,
+    strings: options.strings,
+    cff: options.cff,
+    dead: options.dead,
+    antiHook: options.antiHook
+      ? {
+          enabled: true,
+          lock: Boolean(options.antiHookLock),
+        }
+      : undefined,
+    vm: {
+      enabled: Boolean(options.vm),
+      include: options.vmInclude,
+      opcodeShuffle: options.vmOpcodeShuffle,
+      fakeOpcodes: options.vmFakeOpcodes,
+      bytecodeEncrypt: options.vmBytecode,
+      constsEncrypt: options.vmConsts,
+      downlevel: options.vmDownlevel,
+    },
+    seed: options.seed,
+    ecma: options.ecma,
+    sourceMap: options.sourcemap,
+    compact: options.compact,
+    filename: inputPath === "-" ? "stdin.js" : inputPath,
+  });
+
+  let outputCode = result.code;
+  if (result.map && outputPath) {
+    const mapPath = `${outputPath}.map`;
+    fs.writeFileSync(mapPath, JSON.stringify(result.map), "utf8");
+    outputCode += `\n//# sourceMappingURL=${path.basename(mapPath)}\n`;
+  }
+
+  writeOutput(outputPath, outputCode);
+}
+
+main().catch((err) => {
+  process.stderr.write(`${err && err.stack ? err.stack : err}\n`);
+  process.exit(1);
+});