Obscura — a Rust port of javascript-obfuscator. 100%…
0 reactions
Obscura — a Rust port of javascript-obfuscator. 100% feature parity, ~700× faster
I rewrote javascript-obfuscator in Rust because it was the slowest step in our build. Shipping v0.1.0 today.
Repo: https://github.com/Crash0v3rrid3/obscura
Release: https://github.com/Crash0v3rrid3/obscura/releases/tag/v0.1.0
What it does: Drop-in obfuscator. Same options, same output behavior, same CLI flags. All 21 upstream transforms — string array (with base64/RC4 + rotation/shuffle/index-shift/calls-transform/wrappers), control flow flattening, dead code injection, identifier + property renaming, self-defending, debug protection, domain lock, source maps, the lot.
Speed (heavy preset, single thread):
| File | Size | Upstream | Obscura | Speedup |
| :--- | :--- | :--- | :--- | :--- |
| d3.min.js | 273K | 193.9s | 98ms | 1977× |
| vue.min.js | 141K | 28.6s | 32ms | 900× |
| jquery | 86K | 12.1s | 17ms | 705× |
| lodash | 71K | 14.5s | 21ms | 692× |
| moment | 58K | 8.6s | 16ms | 529× |
| react | 11K | 2.0s | 15ms | 130× |
Median \~700×. CLI also parallelizes directory mode with rayon.
How it stays correct: 321-test conformance suite runs every obfuscated output through vm.runInNewContext to verify behavioral parity with the input. Determinism contract: same (source, options, seed) → byte-identical output across runs (ChaCha20Rng, no wall clock).
Stack: oxc for parse/semantic/codegen, napi-rs for the Node addon, wasm-bindgen for the browser build. Library is #!\[forbid(unsafe\_code)\], zero unwrap in core (clippy-enforced).
Surfaces shipped:
\- cargo install obscura-cli — or grab a binary (macOS arm64/x64, Linux gnu+musl arm64/x64, Windows x64)
\- npm package with prebuilt napi addons (macOS + Linux glibc)
\- WASM (web + nodejs targets)
Not yet: the injected helper templates (self-defending etc.) ship un-re-obfuscated, renamePropertiesMode=unsafe, and ignoreImports. Tracked in docs/TASKS.md. PRs welcome.
Feedback / bug reports / "this output breaks my code" issues very much wanted — the conformance suite catches a lot but real bundles will surface things it can't.
#js #technology #programming #dev
source
I rewrote javascript-obfuscator in Rust because it was the slowest step in our build. Shipping v0.1.0 today.
Repo: https://github.com/Crash0v3rrid3/obscura
Release: https://github.com/Crash0v3rrid3/obscura/releases/tag/v0.1.0
What it does: Drop-in obfuscator. Same options, same output behavior, same CLI flags. All 21 upstream transforms — string array (with base64/RC4 + rotation/shuffle/index-shift/calls-transform/wrappers), control flow flattening, dead code injection, identifier + property renaming, self-defending, debug protection, domain lock, source maps, the lot.
Speed (heavy preset, single thread):
| File | Size | Upstream | Obscura | Speedup |
| :--- | :--- | :--- | :--- | :--- |
| d3.min.js | 273K | 193.9s | 98ms | 1977× |
| vue.min.js | 141K | 28.6s | 32ms | 900× |
| jquery | 86K | 12.1s | 17ms | 705× |
| lodash | 71K | 14.5s | 21ms | 692× |
| moment | 58K | 8.6s | 16ms | 529× |
| react | 11K | 2.0s | 15ms | 130× |
Median \~700×. CLI also parallelizes directory mode with rayon.
How it stays correct: 321-test conformance suite runs every obfuscated output through vm.runInNewContext to verify behavioral parity with the input. Determinism contract: same (source, options, seed) → byte-identical output across runs (ChaCha20Rng, no wall clock).
Stack: oxc for parse/semantic/codegen, napi-rs for the Node addon, wasm-bindgen for the browser build. Library is #!\[forbid(unsafe\_code)\], zero unwrap in core (clippy-enforced).
Surfaces shipped:
\- cargo install obscura-cli — or grab a binary (macOS arm64/x64, Linux gnu+musl arm64/x64, Windows x64)
\- npm package with prebuilt napi addons (macOS + Linux glibc)
\- WASM (web + nodejs targets)
Not yet: the injected helper templates (self-defending etc.) ship un-re-obfuscated, renamePropertiesMode=unsafe, and ignoreImports. Tracked in docs/TASKS.md. PRs welcome.
Feedback / bug reports / "this output breaks my code" issues very much wanted — the conformance suite catches a lot but real bundles will surface things it can't.
#js #technology #programming #dev
source
| 1,000 mlx | |
| 3 | |
| 0 |