CreepJS

The CreepJS trademark policy distinguishes between the software code and the brand identity. While the code is licensed under the MIT License (allowing free use, modification, and distribution), the name "CreepJS" and its logos are protected marks.

Key Distinctions

• The Code: Free to use under MIT.
• The Marks: Restricted to prevent confusion regarding the official source of the project.

If you are creating a derivative project for public use, you are required to rename it to avoid impersonating the official CreepJS™.

SECURITY ALERT: EXTERNAL DOMAINS ARE UNSAFE

The only official live deployment of CreepJS is hosted on GitHub Pages. Any other domains (such as .org, .com, or custom domains) claiming to be CreepJS are unauthorized mirrors and may be malicious honeypots designed to steal fingerprint data.

• ✅ Official: https://abrahamjuliot.github.io/creepjs
• ❌ Unsafe: All other URLs.

To contribute to or develop CreepJS locally, use the following pnpm commands:

• Install dependencies: pnpm install
• Build for development: pnpm build:dev
• Run in watch mode: pnpm watch:dev
• Build for GitHub Pages release: pnpm build

The following uses of the "CreepJS" marks are strictly prohibited to prevent impersonation:

• Domain Names: Registering or using any domain containing "CreepJS" (e.g., creepjs.org, creepjs.net).
• Product Identity: Using "CreepJS" as the primary name for a commercial product, hosted service, or public website.
• Endorsement/Succession: Implying a fork is an "Official", "2.0", "Next Gen", or "successor" version of the original work.

You are allowed to retain the name "CreepJS" in your fork only under specific circumstances:

1. Contributing: When forking specifically to submit Pull Requests or contribute to the official repository.
2. Personal Use: For private study, testing, or internal research.
3. Attribution: When using the name solely to truthfully describe the origin of the code (e.g., "This project is based on CreepJS").

CreepJS provides a suite of tools to detect if browser APIs have been tampered with or are returning 'lies' (fake values used to evade fingerprinting).

Key capabilities include:

• Prototype Analysis: Detecting if native functions (like Date, Navigator, or Canvas) have been modified, proxied, or have incorrect descriptors.
• Plugin/MimeType Validation: Verifying the integrity of navigator.plugins and navigator.mimeTypes to ensure they haven't been spoofed.
• Phantom Environments: Using hidden iframes (PHANTOM_DARKNESS) to run tests in isolated contexts to avoid interference from the main window's environment.

Developers can use getPluginLies to validate plugin arrays and getLies to retrieve the accumulated records of detected tampering.

When calling getCanvasWebgl(), the returned object follows this structure:

{
  "extensions": ["string"],
  "pixels": [number],
  "pixels2": [number],
  "dataURI": "data:image/png;base64,...",
  "dataURI2": "data:image/png;base64,...",
  "parameters": {
    "UNMASKED_VENDOR_WEBGL": "string",
    "UNMASKED_RENDERER_WEBGL": "string",
    "MAX_TEXTURE_SIZE": number,
    "VERTEX_SHADER.LOW_FLOAT.precision": number,
    // ... other WebGL parameters
  },
  "parameterOrExtensionLie": boolean,
  "lied": boolean,
  "gpu": {
    "confidence": "string",
    "grade": "string",
    "parts": "string",
    "gibbers": "string",
    "warnings": ["string"],
    "compressedGPU": "string"
  }
}

The Scope enum and exported variables WORKER_TYPE and WORKER_NAME allow you to identify which type of worker was successfully spawned and used for fingerprinting.

• Scope.WORKER: Indicates the fingerprinting was performed within a worker scope.
• Scope.WINDOW: Indicates the fingerprinting was performed in the main window scope (fallback).

WORKER_TYPE indicates the technical implementation: service (ServiceWorker), shared (SharedWorker), or dedicated (DedicatedWorker).

CreepJS categorizes headless detection into three distinct mental models:

1. Like Headless: Indicators that the environment lacks common features of a full desktop browser, even if it doesn't explicitly claim to be headless. Examples include noPlugins, noMimeTypes, noTaskbar, and noWebShare.
2. Headless: Direct evidence of a headless environment. Examples include webDriverIsOn (detecting navigator.webdriver), presence of HeadlessChrome in the User Agent, or headless User Agents in Web Workers.
3. Stealth: Indicators that the browser is actively trying to lie about its identity. Examples include hasIframeProxy (detecting iframe manipulation), hasToStringProxy (detecting overridden toString methods), and hasBadWebGL (detecting a mismatch between the main thread WebGL renderer and the Web Worker WebGL renderer).

When running in a CreepJS environment, you can access the fingerprinting data through the following global objects:

• window.Fingerprint
• window.Creep