JS-VM-Obfuscator

JS-VM-Obfuscator, or jsvobf for short, is a Babel-based JavaScript obfuscator. Has been put back up on 9/24/26 and is used in many of my other projects

src/
  index.ts              public API
  cli/main.ts           jsvobf command
  core/                 options, shared context, pipeline
  passes/               AST transforms
  vm/                   bytecode compiler and interpreter
  packer/               post-generation wrappers (stage1–3)
  utils/                RNG, codecs, naming, opaque predicates

Requires Node.js 18 or newer.

npm install

Run the CLI against a bundled script (CJS or IIFE). The npm script uses tsx, so a build is not required:

npm run jsvobf -- app.js --preset medium -o app.obf.js

With no -o, the output is written next to the input as app.obf.js.

To install the jsvobf command, build first:

npm run build
npx jsvobf app.js --preset medium -o app.obf.js

Print the full flag list, presets, and examples:

npm run jsvobf -- --help

-h is the same flag. After a build, npx jsvobf --help prints the same text.

index.ts exports the library surface:

• obfuscate(source, options) — parse, transform, generate. Returns { code, stats }.
• PIPELINE_STAGES and stageTimings(stats) — ordered stage names and the time_<stage> measurements stored on stats.
• DEFAULT_OPTIONS, PRESETS, mergeOptions, applyPreset, levelAll.
• packStage1 / packStage2. Stage 3 is CLI-only (packer/stage3.ts).

cli/main.ts is a CLI wrapper for index.ts that reads a bundled .js file, merges flags, runs obfuscate, and packs if requested. Option precedence is defaults, then the JSON config file, then --preset / --level-all, then explicit CLI flags.

core/pipeline.ts runs stages in this order. A stage is a no-op when its option level is 0.

core/context.ts is the object every pass receives.

• Context holds the merged Options, the RNG, a set of names already taken, the runtime builder, and stats.
• RuntimeBuilder collects source fragments from passes (string tables, property resolvers, the VM). Data-only fragments are scattered through the program; the executable IIFE is inserted so it runs before the session initializer. Capability names (decode, vmRun, …) are defined in utils/runtime-api.ts and given a fresh public name per build.
• isRuntimePath lets later passes skip nodes that belong to the injected runtime.

Each transform is a Level (0 | 1 | 2 | 3). 0 is off. Higher levels add work inside that pass:

antidebug stays off in levelAll(). It is on in the insane preset (2) and the compact preset (1).

Presets in core/config.ts: light, medium, heavy, insane, performance (no VM, no MBA), compact (no VM, no CFF, smaller output).

vm/ turns a function into a stub that calls the embedded interpreter.

• ops.ts — opcode names. Numbering is sequential at level 1 and shuffled per build from level 2.
• compile.ts — lowers one function body to bytecode. Throws CompileError when a construct cannot be represented; that function is left as source and counted in stats.
• interpreter.ts — emits the interpreter function for the build's opcode map.
• embed.ts — selects functions at or above vmThreshold statements, compiles them, and installs the runtime entry (vmRun).

Packing runs after generation, in the CLI. Each stage wraps the previous artifact. integrity (on when antidebug >= 2) checks that the function constructor still looks native before invoking the payload.