AwesomeREA.org

Tool

decode-js

Babel-based AST processor that turns obfuscated JavaScript back into readable source, with one target selected per run: javascript-obfuscator (obfuscator.io), JS-Confuser 2.x up to its high preset, sojson and its v7 variant for jsjiami.com.v7, sojson's jjencode variant, and a generic pass for unreachable code, nested blocks and constant expressions. A second, version-aware obfuscator.io target reports the encoder era it detects and returns nothing, with a reason, rather than a half-decoded program when a string-array layer cannot be read. The JS-Confuser notes list each transform it reverses and those, such as variable renaming, that destroy information and cannot be recovered.

Requirements & limits

  • No releases or tags are published; the reviewed main commit of 2026-10-17 runs from source. package.json requires Node.js 26.x to match its native isolated-vm 7 dependency, whose build requirements the README asks users to check first. After npm i, the CLI runs as npm run decode -- -t <target> with optional input and output paths, or through shortcuts such as deob, deobx, dejsc, deso and desov7.
  • Input is a single obfuscated script, input.js by default, and the README says the file must not contain other, non-obfuscated code. Coverage depends on the obfuscator and its version: the version-aware target covers the javascript-obfuscator 2.x eras and 5.5.0, leaves 3.0.0–4.2.2 unverified and reports samples in that range as unknown, and the JS-Confuser target cannot restore RenameVariables, RenameLabels or ObjectExtraction.
  • Decoding evaluates parts of the input: string-array decoders and JS-Confuser runtime helpers run inside isolated-vm sandboxes, but the obfuscator, sojson and sojsonv7 targets unpack an outer eval wrapper with Node.js eval in the decoder's own process. Treat inputs as untrusted code, and check recovered strings and control flow against the original script.
  • CI runs the Vitest suite on Node.js 26; its fixtures pair obfuscated samples, mostly generated from included source files, with expected decodes for the JS-Confuser, obfuscator.io and sojson v7 targets, so they exercise the decoder on project fixtures rather than arbitrary real-world scripts. GPL-3.0-or-later per the README, LICENSE and package.json. No scripts were deobfuscated and the tests were not run for this entry.

About this entry

Type
Tool
Category
Website analysis tools
Relationship
Foundation tool
Targets
Website

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · echo094/decode-js · Revision ca4690a
  2. package.json GitHub · echo094/decode-js · Revision ca4690a
  3. docs/jsconfuser.md GitHub · echo094/decode-js · Revision ca4690a
  4. src/main.js GitHub · echo094/decode-js · Revision ca4690a
  5. src/plugin/eval.js GitHub · echo094/decode-js · Revision ca4690a
  6. src/plugin/obfuscator.js GitHub · echo094/decode-js · Revision ca4690a
  7. src/visitor/obfuscator/string-array.js GitHub · echo094/decode-js · Revision ca4690a
  8. test GitHub · echo094/decode-js · Revision ca4690a
  9. .github/workflows/test.yml GitHub · echo094/decode-js · Revision ca4690a
  10. LICENSE GitHub · echo094/decode-js · Revision ca4690a

More in Websites

All 38 entries in Websites