AwesomeREA.org

Tool

debundle

Node.js command-line tool that unpacks JavaScript bundles produced by Browserify or Webpack back into a tree of module files, so a bundle can be read file by file instead of as one script. A JSON configuration gives the bundle type, the entry-point module and optional knownPaths that map numeric module IDs to output files or node_modules packages, and it can rewrite a minifier's renamed require identifier inline or through a variable so the output can be rebundled or run in Node. The README says it was built to learn how bundles are structured for a reverse-engineering project and that debundling is lossy: package.json settings and Webpack module names are not recovered, and minified code stays minified.

Targets
Website
Category
Website analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • The README calls this a research project that is no longer maintained and says it works in a laboratory environment most of the time but often fails on real-world bundles. The reviewed master commit dates from 2018-06-16; npm's latest debundle release is 0.5.4 of 2017-09-12, newer than the repository's v0.5.3 tag and package.json, and unfinished v2 branches were last updated in 2020.
  • Installs with npm i -g debundle and runs as debundle -i <bundle> -o <directory> -c <config>. package.json requires Node 6 or newer, .nvmrc and the Travis CI configuration use Node 6, and the dependencies date from that period, such as acorn 4 and recast 0.5; behavior on current Node releases was not checked.
  • Only Browserify bundles and Webpack bundles whose modules are passed as an array are decoded: the Webpack decoder aborts when the module list is not an array, and other bundlers are not officially supported, although the moduleAst option can point to a module list with the same layout. Webpack output files are named after module IDs unless knownPaths names them.
  • test_bundles/ holds four small sample bundles with their configurations and original sources, which CI debundles with test_bundles/run_test.sh; the comparison with the original sources is commented out, so CI only checks that debundling finishes. Users supply the bundles to unpack, and the README's legal note warns that some terms of service forbid reverse engineering.
  • package.json and the npm package declare ISC, but the repository has no license file and GitHub detects none; src/extern/replace-method is a vendored MIT-licensed module by Hugh Kennedy. No bundle was unpacked for this entry, and the reviewed sources establish no REA connection.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · 1egoman/debundle · Revision 67531ff
  2. DOCS.md GitHub · 1egoman/debundle · Revision 67531ff
  3. package.json GitHub · 1egoman/debundle · Revision 67531ff
  4. .travis.yml GitHub · 1egoman/debundle · Revision 67531ff
  5. src/decoders/webpack.js GitHub · 1egoman/debundle · Revision 67531ff
  6. test_bundles GitHub · 1egoman/debundle · Revision 67531ff
  7. test_bundles/run_test.sh GitHub · 1egoman/debundle · Revision 67531ff
  8. src/extern/replace-method/LICENSE.md GitHub · 1egoman/debundle · Revision 67531ff
  9. https://www.npmjs.com/package/debundle/v/0.5.4

More in Websites

All 48 entries in Websites