{"id":29603144,"url":"https://github.com/rapid7/jsobfu","last_synced_at":"2025-07-20T14:06:01.305Z","repository":{"id":20945190,"uuid":"24233624","full_name":"rapid7/jsobfu","owner":"rapid7","description":"Obfuscate JavaScript (beyond repair) with Ruby","archived":false,"fork":false,"pushed_at":"2025-03-12T12:13:52.000Z","size":543,"stargazers_count":88,"open_issues_count":2,"forks_count":26,"subscribers_count":83,"default_branch":"master","last_synced_at":"2025-06-20T10:44:43.334Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rapid7.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2014-09-19T14:51:20.000Z","updated_at":"2025-04-01T07:36:53.000Z","dependencies_parsed_at":"2022-09-07T13:40:16.604Z","dependency_job_id":null,"html_url":"https://github.com/rapid7/jsobfu","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/rapid7/jsobfu","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rapid7%2Fjsobfu","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rapid7%2Fjsobfu/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rapid7%2Fjsobfu/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rapid7%2Fjsobfu/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rapid7","download_url":"https://codeload.github.com/rapid7/jsobfu/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rapid7%2Fjsobfu/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":266135685,"owners_count":23881803,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-07-20T14:06:00.434Z","updated_at":"2025-07-20T14:06:01.290Z","avatar_url":"https://github.com/rapid7.png","language":"JavaScript","funding_links":[],"categories":["JavaScript"],"sub_categories":[],"readme":"JSObfu\n==\nJSObfu is a Javascript obfuscator written in Ruby, using the [rkelly-remix](http://rubygems.org/gems/rkelly-remix) library. The point is to obfuscate beyond repair, by randomizing as much as possible and removing easily-signaturable string constants.\n\n### Installation\n\nTo use JSObfu in your project, just add the following line to your Gemfile:\n\n    gem 'jsobfu'\n\nOr, to install JSObfu on to your system, run:\n\n    $ gem install jsobfu\n\n### Documentation\n\nGenerated documentation is hosted [on Github](http://rapid7.github.io/jsobfu/doc/).\n\n### Example Usage\n\nObfuscating a Javascript string in ruby:\n\n    require 'jsobfu'\n\n    source = %Q|\n      // some sample javascript code, to demonstrate usage:\n      this.send_websocket_request = function(address, callback) {\n        // create the websocket and remember when we started\n        try {\n          var socket = new WebSocket('ws://'+address);\n        } catch (sec_exception) {\n          if (callback) callback('error', sec_exception);\n          return;\n        }\n        var try_payload = function(){\n          TcpProbe.send(\"AAAAAAAAAAAAAAAAAAAAAAAAAA\"+\n                        \"AAAAAAAAAAAAAAAAAAAAAAAAAA\"+\n                        \"AAAAAAAAAAAAAAAAAAAAAAAAAA\");\n        }\n        // wait a sec, then start the checks\n        setTimeout(check_socket, WS_CHECK_INTERVAL);\n      };\n    |\n\n    puts JSObfu.new(source).obfuscate\n\nWill produce something that looks like:\n\n    this[((function () { var A=\"st\",K=\"ket_reque\",P=\"_send_webs\",Z=\"oc\"; return P+Z+K+A }\n    )())]=function(\\u006b,U){var e;try{var B;var B=new window[(function () { var G=\"t\",Rr\n    =\"e\",C=\"We\",$=\"bSock\"; return C+$+Rr+G })()]((function () { var R9='/',x='s:/',xe='w'\n    ; return xe+x+R9 })()+k);} catch(a){if(U)U((function () { var b='or',cF='r',E='e',f='\n    r'; return E+f+cF+b })(),a);return;}var e=function(){window[(function () { var t=\"e\",\n    L=\"pProb\",j=\"T\",z=\"c\"; return j+z+L+t })()][((function () { var zp=\"d\",D=\"sen\"; retur\n    n D+zp })())]((function () { var KL=\"AAAAAAAAAAAA\",y6=\"AAAAAAAAAAAAAA\"; return y6+KL\n    })()+String.fromCharCode(0x41,0x41,0101,0101,65,65,0x41,65,0101,65,0x41,0101,0x41,010\n    1,0101,0101,65,65,0x41,0x41,0x41,65,65,0101,0x41,0x41)+String.fromCharCode(0x41,0x41,\n    0x41,65,0x41,0101,0x41,0x41,0101,0101,0101,0101,0101,0101,0101,0101,0x41,65,65,65,010\n    1,0x41,0101,0x41,0101,0101));};setTimeout(this[((function () { var TF=\"et\",D=\"k\",B=\"c\n    heck_s\",S=\"oc\"; return B+S+D+TF })())],('Mcc'.length*51+47));};\n\n\nEncode from the command line:\n\n    $ cat source.js | jsobfu 3\n\nOptions for obfuscation iterations and global object names can be passed:\n\n    JSObfu.new(blah).obfuscate(iterations: 3, global: 'this')\n\n### Memory Disruption\n\nObfuscation of this type can cause completely different memory footprints on every run. This can be annoying in some instances (like during a heap spray). To avoid this, a `memory_sensitive` option is provided:\n\n    JSObfu.new('var me = \"BAR\";\\nvar description = \"FOO\" + me;').obfuscate(memory_sensitive: true)\n    #=\u003e var y=\"BAR\";var x=\"FOO\"+y;\n\nNote that the variables are still randomized and whitespace is stripped, but the String transformations are omitted.\n\n### Obfuscating multiple inputs\n\nTypically you will want to create a new `JSObfu` instance per script you create, but sometimes you need the ability to generate obfuscated code on-demand that is compatible with other, already obfuscated scripts in the page. To do this you can reuse a `JSObfu` instance by replacing its `code` member:\n\n    j1 = JSObfu.new('var JSObfu = 1;')\n    j1.obfuscate           #=\u003e 'var y = 1;'\n\n    j1.code = 'var Value2 = JSObfu + 2;'\n    j1.obfuscate           #=\u003e 'var x = y + 2;'\n\nAlternatively, you can persist the instance's `#scope` (which contains a map of top-level variable renames) and pass it into a new instance of `JSObfu` later:\n\n    j1 = JSObfu.new('var JSObfu = 1;')\n    j1.obfuscate           #=\u003e 'var y = 1;'\n\n    j2 = JSObfu.new('var Value2 = JSObfu + 2;', scope: j1.scope)\n    j2.obfuscate           #=\u003e 'var x = y + 2;'\n\n### Deobfuscation\n\nJust as coding these transformations is possible, so is the inverse. Hats off to [@m1el](https://github.com/m1el) for creating a [jsobfu deobfuscator](http://m1el.github.io/esdeobfuscate/)! Don't forget, `jsobfu` will never stop a determined analyst; but it can be very helpful against static detection.\n\n### Development Environment\n\nSetting up is easy:\n\n    $ cd jsobfu\n    $ bundle install\n\n### Generating documentation\n\n    $ yard \u0026\u0026 yard server --port 9999\n\nThen open [http://localhost:9999](http://localhost:9999) in your browser.\n\n### Running specs\n\n    $ rake spec\n\nTo run without integration specs, set `INTEGRATION=false` as an environment variable.\n\n### License\n\n[BSD-3-Clause](http://opensource.org/licenses/BSD-3-Clause)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frapid7%2Fjsobfu","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frapid7%2Fjsobfu","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frapid7%2Fjsobfu/lists"}