Is it possible to use the javascript-obfuscator library on the browser?

Viewed 1836

I am trying to obfuscate some javascript code using the following library:

https://github.com/javascript-obfuscator/javascript-obfuscator

I had success using Node.js but I would like it on the browser by simply calling the obfuscator methods from javascript.

The documentation says:

In a browser:

From node_modules:

<script src="./node_modules/javascript-obfuscator/dist/index.browser.js"/>

I have successfully installed the js-obfuscator library using NPM and added the above CDN code in the head section of my index.html

At this point I don't know whether it is possible to instantiate the object jsObfuscator without using :

let JavaScriptObfuscator = require('javascript-obfuscator');

I am making a simple client side plugin which returns the obfuscated version of the code you input in. This runs as simple static page index.html, where I cannot use require.

If I try and use the following function code, the jsObfuscator is not defined as I did not use the require method.

function obfuscation(data) {
  let obfuscationResult = jsObfuscator.obfuscate(data, {
    compact: true,
    controlFlowFlattening: true,
    deadCodeInjection: true,
    deadCodeInjectionThreshold: 0.4,
    reservedNames: [
      'setup',
      'draw'
    ],
    reservedStrings: [
      'setup',
      'draw'
    ],
    renameGlobals: true
  });
  return obfuscationResult;
}

Do you know how and if it is possible to use the jsObfuscator library on the browser?

2 Answers

Yes, this is possible, but it is not reasonable, because client's browser firstly download the JavaScript source code, code of the library, runs them and finally gets obfuscated code. Source code of the page with all scripts still will be accessible from browser, and user may easily get it.

I have found the solution if anyone might be interested one day.

By looking at the index.browser.js in the dist folder of the project, the package is exported as JavaScriptObfuscator, so you have to reference that instead of jsObfuscator.

Related