Javascript obfuscation detector
npm install obfuscation-detectorUse Cases:
- Automated analysis of suspicious or third-party JavaScript
- Security auditing and malware research
- Integration into CI/CD pipelines to flag obfuscated code
- Educational purposes for understanding obfuscation techniques
shell
npm install obfuscation-detector
`Usage
$3
`javascript
import fs from 'node:fs';
import detectObfuscation from 'obfuscation-detector';const code = fs.readFileSync('obfuscated.js', 'utf-8');
const bestMatch = detectObfuscation(code); // returns [bestMatch] or []
const allMatches = detectObfuscation(code, false); // returns all matches as an array
console.log(
Obfuscation type(s): ${allMatches.join(', ')});
`$3
`shell
obfuscation-detector /path/to/obfuscated.js [--bestMatch|-b]
cat /path/to/obfuscated.js | obfuscation-detector [--bestMatch|-b]
obfuscation-detector --help
`#### CLI Options
-
--bestMatch, -b: Return only the first (most likely) detected obfuscation type.
- --help, -h: Show usage instructions.
- Unknown flags will result in an error and print the usage.#### Examples
- All matches:
`shell
$ obfuscation-detector /path/to/obfuscated.js
[+] function_to_array_replacements, augmented_proxied_array_function_replacements
`
- Best match only:
`shell
$ obfuscation-detector /path/to/obfuscated.js --bestMatch
[+] function_to_array_replacements
`
- From stdin:
`shell
$ cat obfuscated.js | obfuscation-detector -b
[+] function_to_array_replacements
`API Reference
$3
- code: JavaScript source code as a string.
- stopAfterFirst: If true, returns after the first positive detection (default). If false, returns all detected types.
- Returns: An array of detected obfuscation type names. Returns an empty array if no known type is detected.Supported Obfuscation Types
Descriptions and technical details for each type are available in src/detectors/README.md:
- Array Replacements
- Augmented Array Replacements
- Array Function Replacements
- Augmented Array Function Replacements
- Function To Array Replacements
- Obfuscator.io
- Caesar PlusTroubleshooting
- No obfuscation detected: The code may not be obfuscated, or it uses an unknown technique. Consider contributing a new detector!
- Error: File not found: Check the file path and try again.
- Unknown flag: Run with only --help` to see what options are available.---
For technical details on each obfuscation type and how to add new detectors, see src/detectors/README.md.