Registry / auth-security / js-virtualizer

js-virtualizer

library1.0.2jsnpmunverified

A proof-of-concept JavaScript obfuscation tool that converts individual functions into bytecode executed by a custom virtual machine (VM) written in JavaScript. Version 1.0.2 is the current and only release. The transpiler converts functions marked with `// @virtualize` into opcodes for the VM. Key differentiators: unlike traditional obfuscators that rename/transform AST, this executes code in an interpreted VM, making reverse engineering significantly harder. Not intended for whole programs due to performance overhead; targets server-side Node.js, not browsers. Development appears stalled (no updates since initial release).

auth-security

npm install js-virtualizer

github ↗package ↗

INSTALL

IMPORT

SIG · JS-VIRTUALIZER

js-virtualizer

auth-securityjavascriptv1.0.2

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

transpile

✓ import { transpile } from 'js-virtualizer'

✗ const transpile = require('js-virtualizer').transpile

Both ESM and CJS are supported. The package exports transpile as a named export.

✓ import { VM } from 'js-virtualizer'

✗ const jsVirtualizer = require('js-virtualizer'); const VM = jsVirtualizer.VM;

VM is the virtual machine class. It is exported as a named export but rarely used directly – transpile() generates code that uses VM internally.

execute

✓ import { execute } from 'js-virtualizer'

execute function is not part of the public API. It is an internal detail. Use transpile() instead.

Demonstrates transpiling a simple virtualized function with multiple passes, writing output to files, and handling configuration options.

const { transpile } = require('js-virtualizer'); async function main() { const code = ` // @virtualize function add(a, b) { return a + b; } add(1, 2); `; const result = await transpile(code, { fileName: 'example', writeOutput: false, vmOutputPath: './vm_output.js', transpiledOutputPath: './output.js', passes: ['RemoveUnused', 'ObfuscateVM', 'ObfuscateTranspiled'] }); console.log('Transpiled code:', result.code); } main().catch(console.error);

js-virtualizer --version

Debug

Known issues

gotchaOnly functions marked with // @virtualize comment are transpiled. Other code is left as-is, which can lead to mixed code that may not execute correctly.

fix

Ensure all functions that should be virtualized have the exact comment // @virtualize on the line immediately above the function declaration.

affects: >=1.0.0

gotchaVirtualizing an entire program or large functions will cause severe performance degradation. The VM is designed for small, isolated functions only.

fix

Only use // @virtualize on small, critical functions. Test performance impact before production.

affects: >=1.0.0

gotchaAsync functions running concurrently are not supported. The VM executes asynchronous operations sequentially.

fix

Avoid using concurrent async functions inside virtualized code. Use sequential awaits or callbacks.

affects: >=1.0.0

gotchaThe package is intended for Node.js server-side only. It uses require() internally and has not been tested in browsers.

fix

If using in a browser, replace require() calls in vm_dist.js with browser-compatible imports (e.g., ES modules or window globals).

affects: >=1.0.0

gotchaThe default VM file (vm_dist.js) includes opcode names in plain text, making reverse engineering easier. It is recommended to modify and obfuscate this file before production use.

fix

Edit src/vm_dist.js to rename opcode identifiers and apply obfuscation to the VM itself.

affects: >=1.0.0

deprecatedThis project appears to be a proof-of-concept with no updates since initial release. The API may not be stable.

fix

For production obfuscation, consider alternatives like jscrambler, javascript-obfuscator, or commercial solutions. Maintain your own fork if needed.

affects: >=1.0.0

Errors

Common errors & fixes

Error: The code does not contain any // @virtualize comments.

No functions were marked with the required comment, so the transpiler produces no output.

fix

Add // @virtualize as a comment line immediately before the function declaration you want to virtualize.

TypeError: Cannot read properties of undefined (reading 'code')

Running transpile() without await may return a Promise object instead of the result object.

fix

Use await or .then() to handle the asynchronous transpile() call.

Error: The virtualized function uses 'this' incorrectly.

The VM does not support a function accessing its own 'this' property. Arrow functions or methods may fail.

fix

Refactor the virtualized function to avoid relying on 'this'. Use explicit parameters or bind the context outside.

Upgrade

Version history

1.0.2latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

11 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/aesthetic0001/js-virtualizer ↗

packagehttps://www.npmjs.com/package/js-virtualizer ↗