NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
npm
JavaScript obfuscator
Last release 9 days ago
04 Oct 2026
Ships fairly regularly
a new release about every 4 weeks
Most releases are documented
notes for 40 of the last 60 stable releases
Nothing withdrawn
no release was ever pulled
10 years old
273 releases · first in 2016
Pro API: added getProQuota() , which returns the usage left on the API key's plan.
getProQuota(), which returns the usage left on the API key's plan.ApiError now carries code, the machine-readable cause sent by the API; a build refused for quota has code dailyLimit or monthlyLimitdist bundle is no longer minified, so uncaught errors print a readable stack frame instead of the whole bundle.One column per quarter.
transformObjectKeys making default parameter objects shared across calls. Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1455controlFlowFlattening breaking short-circuit evaluation of &&, || and ??. Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1456Pro API: added support for custom presets. optionsPreset accepts the alias of a custom preset saved in the obfuscator.io dashboard; obfuscatePro() and
optionsPreset accepts the alias of a custom preset saved in the obfuscator.io dashboard; obfuscatePro() and the CLI (--pro-api-token) fetch it and merge its options--options-preset with a VM preset name (e.g. vm-default) no longer fails locally when --pro-api-token is set; the name is passed to the Pro APINew option: advertisement allows to control the display of the JavaScript Obfuscator Pro advertisement message in the console. Fixed #1448
advertisement allows to control the display of the JavaScript Obfuscator Pro advertisement message in the console. Fixed #1448Pro API: obfuscatePro now fall back to the basic local obfuscation API when no Pro feature ( vmObfuscation or parseHtml ) is enabled, instead of throw
obfuscatePro now fall back to the basic local obfuscation API when no Pro feature (vmObfuscation or parseHtml) is enabled, instead of throwing an ApiErrorstringArrayEncoding runtime performanceFixed leading whitespace of the source code being stripped without being reflected in the source map, shifting all sourcesContent and original positio
sourcesContent and original position mappings. Fixes #1437Pro API: reworked large file uploads — fixed 413 Content Too Large for ~4.4–4.6MB request bodies, and Blob uploads now send the raw source ( blobForma
413 Content Too Large for ~4.4–4.6MB request bodies, and Blob uploads now send the raw source (blobFormat: 'raw') instead of the JSON request body, so uploads always fit the plan's file size capBumped the production brace-expansion transitive dependency to a patched version, resolving CVE-2026-25547 . Fixes #1405
sourceMapFileName making all files share and overwrite one .map. Fixes #817--config failures hiding the real cause behind a generic Cannot open config file message. Fixes #1101sourceMapFileName ending in .js.map (e.g. foo.min.js.map) being mangled in the emitted //# sourceMappingURL= comment. Fixes #1312URIError: URI malformed crash when stringArray with base64/rc4 encoding processed a string literal containing lone surrogate code units (e.g. "[^\uD800-\uDFFF]"). Fixes #1431brace-expansion transitive dependency to a patched version, resolving CVE-2026-25547. Fixes #1405Fixed unicode ( \uXXXX , \u{XXXX} ) and hex ( \xXX ) escape sequences of string literals being un-escaped into their literal characters during obfusca
\uXXXX, \u{XXXX}) and hex (\xXX) escape sequences of string literals being un-escaped into their literal characters during obfuscation. Fixes #345Fixed controlFlowFlattening intermittently dropping arguments of a spread call (e.g. foo(...args) ) when it reused a control flow wrapper of a same-ar
controlFlowFlattening intermittently dropping arguments of a spread call (e.g. foo(...args)) when it reused a control flow wrapper of a same-arity plain call. Fixes #1423selfDefending making obfuscated code run several times slower on Bun/JavaScriptCore. Fixes #1421in operator inside an arrow body in a for-init, producing unparsable output. Fixes #1419Optimized scope identifiers transformer performance
Invalid regular expression error when obfuscating code that uses ES2025 RegExp pattern modifiers (e.g. /(?i:abc)/). Fixes #1410SyntaxError when obfuscating a class that extends a boolean literal (e.g. class C extends true {}). Fixes #1131Fixed controlFlowFlattening occasionally dropping the ?. short-circuit on foo?.(arg) calls, causing TypeError: <X> is not a function . Fixes #1408
controlFlowFlattening occasionally dropping the ?. short-circuit on foo?.(arg) calls, causing TypeError: <X> is not a function. Fixes #1408controlFlowFlattening occasionally dropping the ?. short-circuit on foo?.(arg) calls, causing TypeError: <X> is not a function. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1408Fixed obfuscated code hanging in Bun when selfDefending is enabled. Fixes #1404
selfDefending is enabled. Fixes #1404Fixed Utils.nodeRequire causing ReferenceError: require is not defined in browser build by making it lazy-evaluated
Utils.nodeRequire causing ReferenceError: require is not defined in browser build by making it lazy-evaluatedreturn, throw, typeof) and Unicode surrogate pair identifiers in compact mode. Fixes #1112domainLock being case-sensitive — domain values are now normalized to lowercase. Fixes #1182source-map-support runtime dependency. Use node --enable-source-maps instead. Fixes #1149Add support for import attributes. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1256
import attributes. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1256renameProperties support for private class fields and methods (#foo, #bar()). Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1220reservedNames not preserving class method and property names when stringArray or deadCodeInjection is enabled. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1279reservedNames patterns match all generated identifier names. Now throws a descriptive error instead. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1382transformObjectKeys changing evaluation order when object expression is inside a sequence expression with preceding side effects (e.g. return aux(ys), { min }). Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1246renameGlobals is disabled. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1141--options-preset not applying preset values for options not explicitly set via command line (e.g. splitStrings from high-obfuscation preset was ignored). Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1236mkdirp dependency with native fs.mkdirSync({ recursive: true }). Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1275. Thank you https://github.com/roli-lpci!renameProperties breaking modern built-in methods like Array.prototype.at(). Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1066conf dependency with custom implementation using env-paths and native fsFixed class expression name references inside class body being incorrectly resolved to an import binding with the same name, causing broken code at ru
Add large files upload support to Pro API
Nothing published for this version
Fixed transformObjectKeys incorrectly hoisting object literal outside of loop when loop body is a single statement without braces, causing all iterati
transformObjectKeys incorrectly hoisting object literal outside of loop when loop body is a single statement without braces, causing all iterations to share the same object reference. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1300await is used as an identifier in non-async context. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1127deadCodeInjection causing SyntaxError when arguments from collected block statements was injected into class field initializers or static initialization blocks. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1166transformObjectKeys with mangled identifier generator causing variable shadowing when extracted object variable name matched an existing inner scope variable. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1232Skip obfuscation of process.env.*
process.env.*controlFlowFlattening breaking short-circuit evaluation with spread operator and conditional objects. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1372NodeUtils.cloneRecursive corrupting range property when cloning AST nodes, causing scope analysis to incorrectly resolve destructuring default parameter referencesAdd version parameter to the apiConfig to use different versions JavaScript Obfuscator Pro via API
version parameter to the apiConfig to use different versions JavaScript Obfuscator Pro via APIAdd JavaScript Obfuscator PRO advertisement message
Add JavaScript Obfuscator PRO support via calling its API
Nothing published for this version
Downgrade multimatch version to avoid esm errors
multimatch version to avoid esm errorsDropped support of Node versions 17 and below
transformObjectKeys performance in some edge-casescontrolFlowFlattening + optional chaining compatibility. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1325Improved stringArray calls wrapper templates commit. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1330class-validator version. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1324.mjs and .cjs extensions. Kudos to https://github.com/javascript-obfuscator/javascript-obfuscator/pull/1301Update supported Node.js versions up to node@22. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/pull/1100
node@22. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/pull/1100class-validator version. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1247* Add target service-worker
service-worker* Add support for node@18 * Update dependencies
node@18Update class-validator dependency https://github.com/javascript-obfuscator/javascript-obfuscator/pull/1146
class-validator dependency https://github.com/javascript-obfuscator/javascript-obfuscator/pull/1146Breaking change: debugProtectionInterval option now accepts value in milliseconds instead of boolean value. Fixed https://github.com/javascript-obfusc…
debugProtectionInterval option now accepts value in milliseconds instead of boolean value. Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1031Fixed cases when dead code is added to the inner code of eval expressions. Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues
eval expressions. Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1053Improved integration between renameProperties and controlFlowFlattening options. Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/
renameProperties and controlFlowFlattening options. Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1053Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1056
Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1052
Fixed missing transformation of string array calls in some cases
Map or Set for mangled and mangled-shuffled identifier names generatorsFixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1039
* Updated copyright
New options: stringArrayCallsTransform and stringArrayCallsTransformThreshold
stringArrayCallsTransform and stringArrayCallsTransformThresholdAdded support of es2022 features: class static block
es2022 features: class static blockFixed performance for Apple M1 chip
Fixed CVE-2019-18413. Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues/880
ignoreRequireImports option renamed to ignoreImportsrotateStringArray option renamed to stringArrayRotateshuffleStringArray option renamed to stringArrayShuffleignoreImports now ignores dynamic imports in addition to require imports@javascript-obfuscator/escodegen with fixed parenthesis of default export IIFErotateStringArray couldn't rotate array properlyselfDefending optionnpm package now has types directory and doesn't have src directory@javascript-obfuscator/escodegen with fixed generation of private property nameses2022 features: private identifiers and class propertiesnode@15node versions: ^12.22.0 || ^14.17.0 || >=16.0.0sourceMapSourcesMode allows to control sources and sourcesContent fields of the source mapinputFileName option now required when using NodeJS API and sourceMapSourcesMode option has sources value`sourceMapFileName option is setstringArrayWrappersType: 'function' now generates different indexes between each wrapper inside the same lexical scopestringArrayWrappersType: 'function' now generates different parameters order between each wrapper inside the same lexical scopestringArrayWrappersType: 'function' now appends FunctionDeclaration functions instead of FunctionExpression functions. This allows to append these wrappers at random positions inside each scoperenameProperties option now won't generate duplicated property names in some casestransformObjectKeys option now completely ignores objects with CallExpression or NewExpression nodes. Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues/948stringArray calls wrapper decode codestringArray calls wrapper codedeadCodeInjection and stringArrayWrappersChainedCalls optionstransformObjectKeys option when object values contains this references. Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues/937domainDest => domainLockRedirectUrl option renamedomainDest option that option allows the browser to be redirected to a passed domain if the source code isn't run on the domains or URL specified by domainLock. Thank you https://github.com/erikdubbelboer!ObfuscationResult object now contains getOptions method to get options that were used during obfuscationidentifierNamesCache option for reading and writing identifier names cache. See README.md.--identifier-names-cache-path option for reading and writing identifier names cache. See README.md.controlFlowFlattenig option is enabled. Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues/920node@16 and dropped support of node@10. This should not affect obfuscated codestringArray calls wrappers now inserted as FunctionDeclaration nodes at random indexesrenamePropertiesMode to switch between new safe and old unsafe modes of renameProperties option. Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues/878renameProperties option now works in safe way by defaulttop-level await. Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues/884controlFlowFlattening option is enabled. Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues/887numbersToExpressions option for float numbers. Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues/882simplify option regression after 2.10.2. Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues/864simplify options when a node with a single-statement body is inside simplified IfStatement node. Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues/860base64 encoded strings from atob code helper to prevent mutation of RegExp.$1 value during calls to the stringArray. Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues/829rotateStringArray optionNothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Your coding agent can read these notes before it upgrades. Set up the MCP server →