webpack-obfuscator

When using the plugin, you can provide an excludes argument (an Array or String) to bypass obfuscation for specific output files. The syntax follows the multimatch package. This is useful for preventing the obfuscation of specific entry points or bundles.

// webpack.config.js
'use strict';

const JavaScriptObfuscator = require('webpack-obfuscator');

module.exports = {
    entry: {
        'abc': './test/input/index.js',
        'cde': './test/input/index1.js'
    },
    output: {
        path: 'dist',
        filename: '[name].js' // output: abc.js, cde.js
    },
    plugins: [
        new JavaScriptObfuscator({
            rotateStringArray: true
        }, ['abc.js'])
    ]
};

Install the plugin and its dependency javascript-obfuscator as devDependencies. This plugin requires Webpack@5. If you are using Webpack@4, you must use version 2 of this plugin.

npm install --save-dev javascript-obfuscator webpack-obfuscator

To use the Pro API with the loader, include proApiConfig and onProgress within the options object of the loader rule.

var WebpackObfuscator = require('webpack-obfuscator');

rules: [
    {
        test: /\.js$/,
        enforce: 'post',
        use: {
            loader: WebpackObfuscator.loader,
            options: {
                rotateStringArray: true,
                // Pro API configuration
                proApiConfig: {
                    apiToken: 'your-api-token-from-obfuscator.io',
                    timeout: 300000  // optional
                },
                // optional progress callback
                onProgress: (message) => {
                    console.log('Obfuscation progress:', message);
                }
            }
        }
    }
]

To use the Pro API with the plugin, pass a third argument containing the proApiConfig and an optional fourth argument for a progress callback.

var WebpackObfuscator = require('webpack-obfuscator');

plugins: [
    new WebpackObfuscator(
        {
            // obfuscator options
            rotateStringArray: true
        },
        ['excluded_bundle_name.js'],  // excludes
        {
            // Pro API configuration
            apiToken: 'your-api-token-from-obfuscator.io',
            timeout: 300000  // optional, request timeout in ms (default: 5 minutes)
        },
        (message) => {
            // optional progress callback
            console.log('Obfuscation progress:', message);
        }
    )
]

To obfuscate your entire bundle, add WebpackObfuscator to your Webpack plugins array. You can pass obfuscatorOptions as the first argument and an excludes array as the second argument.

var WebpackObfuscator = require('webpack-obfuscator');

// webpack plugins array
plugins: [
    new WebpackObfuscator ({
        rotateStringArray: true
    }, ['excluded_bundle_name.js'])
]

To obfuscate specific modules, define a rule in your Webpack rules array. Use WebpackObfuscator.loader and it is highly recommended to add the enforce: 'post' flag to ensure the loader runs after your other loaders have processed the files.

var WebpackObfuscator = require('webpack-obfuscator');

// webpack loader rules array
rules: [
    {
        test: /\.js$/,
        exclude: [
            path.resolve(__dirname, 'excluded_file_name.js')
        ],
        enforce: 'post',
        use: {
            loader: WebpackObfuscator.loader,
            options: {
                rotateStringArray: true
            }
        }
    }
]

The package exports TypeScript types for Pro API configuration and progress callbacks.

import WebpackObfuscator, { IProApiConfig, TProApiProgressCallback } from 'webpack-obfuscator';

const proApiConfig: IProApiConfig = {
    apiToken: 'your-token',
    timeout: 60000
};

const onProgress: TProApiProgressCallback = (message) => {
    console.log(message);
};

The plugin accepts WebpackObfuscatorOptions, which is a subset of the standard ObfuscatorOptions from the javascript-obfuscator library.

Specifically, the following keys are omitted from the options object because the plugin manages them internally to ensure correct source map handling and file naming within the Webpack lifecycle:

• inputFileName
• sourceMapBaseUrl
• sourceMapFileName
• sourceMapMode
• sourceMapSourcesMode

The loader options are a combination of standard ObfuscatorOptions from the javascript-obfuscator package, with some keys omitted and new ones added for Webpack integration.

Omitted Keys (handled automatically by the loader):

• inputFileName (set to the relative path of the module)
• sourceMapBaseUrl
• sourceMapFileName
• sourceMapMode (forced to 'separate')
• sourceMapSourcesMode

Additional Keys:

• proApiConfig: Configuration for the Pro API to enable asynchronous, advanced obfuscation (IProApiConfig).
• onProgress: A callback function (TProApiProgressCallback) to track the progress of the obfuscation process when using the Pro API.