AwesomeREA.org

Tool

bun-demincer

Node.js pipeline that recovers readable JavaScript from Bun-compiled standalone executables. It extracts the embedded module graph and assets, splits the bundle into one file per module, flags npm vendor code with a fingerprint database, and deobfuscates with wakaru, format-preserving renames recovered from export mappings and optional Gemini-suggested names. Dependency-graph clustering, manual or LLM-assisted cluster labels and cross-version artifact transfer then organize and update the output.

Targets
App · Binary
Category
JavaScript and Electron tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • The reviewed master commit of 2026-03-06 is the repository’s ninth, three days after its initial release commit of 2026-03-03; there are no tags or releases. It needs Node.js 18+ and the npm dependencies in package.json, including node-canvas for cluster PNGs; Bun is needed only to run extracted code. The README says Bun stores the code in a __BUN Mach-O section, appended ELF data or a .bun PE section; extract.mjs parses the Mach-O section header and otherwise searches for Bun's trailer.
  • Input is a Bun-compiled executable the user is entitled to analyze; the repository contains no target binaries or recovered code, and .gitignore excludes pipeline output. data/vendor-fingerprints-1000.json (26 MB) holds property-name and string-literal fingerprints for 23,746 files from 1,668 npm packages and can be rebuilt from a local node_modules. The README says steps 1–4 are automated, while cluster labels need manual input or an LLM.
  • ai-rename.mjs and ai-rename-scoped.mjs send module source to Google's Gemini API with a GEMINI_API_KEY (default model gemini-3-flash-preview); their names are model suggestions. The README's round-trip reassembly calls a build.mjs it marks as part of the user's project, which this repository does not contain, so the claim that output reassembles into a working binary was not checked.
  • The reviewed tree has no tests or CI. The README states MIT, but there is no license file and package.json has no license field. Four of the nine commits carry a Claude Opus 4.6 co-author trailer; REA use is not established. Nothing was installed or run.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · vicnaum/bun-demincer · Revision 7cfe925
  2. package.json GitHub · vicnaum/bun-demincer · Revision 7cfe925
  3. .env.example GitHub · vicnaum/bun-demincer · Revision 7cfe925
  4. .gitignore GitHub · vicnaum/bun-demincer · Revision 7cfe925
  5. docs/BUN.md GitHub · vicnaum/bun-demincer · Revision 7cfe925
  6. src/extract.mjs GitHub · vicnaum/bun-demincer · Revision 7cfe925
  7. src/match-vendors.mjs GitHub · vicnaum/bun-demincer · Revision 7cfe925
  8. src/ai-rename.mjs GitHub · vicnaum/bun-demincer · Revision 7cfe925
  9. src/cluster-graph.mjs GitHub · vicnaum/bun-demincer · Revision 7cfe925
  10. https://github.com/vicnaum/bun-demincer/commit/4ff57a9fff40b2a509b32cfd93d76a22fd37933a

More in Apps

All 116 entries in Apps