AwesomeREA.org

Tool

sourcemapper

Go command-line tool that recreates a web front end's original JavaScript source tree from a source map generated by webpack or a similar bundler, writing each embedded source file under the path the map records. It takes a .map file by URL or local path, walks a directory of .map files, or fetches a JavaScript file and follows its sourceMappingURL comment or SourceMap response header, including inline data: maps.

Requirements & limits

  • The project publishes no releases or tags. The README installs it with go install, a clone-and-build, or the BlackArch package; go.mod declares Go 1.16 and lists no third-party modules. The reviewed master commit, dated 2026-07-24, also adds the -dir batch mode and refuses to read a local path named by a remote sourceMappingURL.
  • Only one of -url, -jsurl or -dir is accepted per run, and -output is required. Remote fetches can carry extra request headers, go through a proxy or skip TLS verification. The README warns that a JavaScript file parsed with -jsurl can make sourcemapper send a GET request to any URL it names as its source map.
  • The input is a source map the user may inspect. The tool reads only the map's version, sources and sourcesContent fields, so maps without embedded sourcesContent are rejected and minified bundles without a map are out of scope; the mappings are not used, and output is the bundler's captured source text, not code verified against the deployed bundle.
  • BSD-3-Clause. Recovered front-end code remains subject to the site owner's rights. The README links a 2018 Pulse Security article describing its use for front-end source review in a penetration test. Nothing was built or run against any site.

About this entry

Type
Tool
Category
Website analysis tools
Relationship
Foundation tool
Targets
Website

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · denandz/sourcemapper · Revision f739bd5
  2. README.md#L124 GitHub · denandz/sourcemapper · Revision f739bd5
  3. main.go#L22-L28 GitHub · denandz/sourcemapper · Revision f739bd5
  4. main.go#L290-L327 GitHub · denandz/sourcemapper · Revision f739bd5
  5. go.mod GitHub · denandz/sourcemapper · Revision f739bd5
  6. LICENSE GitHub · denandz/sourcemapper · Revision f739bd5
  7. https://pulsesecurity.co.nz/articles/javascript-from-sourcemaps

More in Websites

All 33 entries in Websites