Registry / devops / vite-plugin-javascript-obfuscator

vite-plugin-javascript-obfuscator

library3.1.0jsnpmunverified

vite-plugin-javascript-obfuscator is a Vite plugin designed to integrate the `javascript-obfuscator` library into Vite projects, enabling code obfuscation during the build or serve process. The current stable version is 3.1.0. This plugin allows developers to apply various obfuscation techniques to their JavaScript, JSX, TypeScript, and TSX files, helping to protect source code from reverse engineering and tampering. It provides a configurable interface to pass options directly to `javascript-obfuscator`, including `debugProtection`, `controlFlowFlattening`, and many others, allowing fine-grained control over the obfuscation intensity and effects. Its key differentiator is seamless integration within the Vite ecosystem, leveraging Vite's HMR for development and optimized builds for production, making it easy to add a layer of code protection without complex build-tool configurations. There is no publicly stated strict release cadence, but updates align with `javascript-obfuscator` and Vite ecosystem changes.

devops auth-security

npm install vite-plugin-javascript-obfuscator

github ↗package ↗

INSTALL

IMPORT

SIG · VITE-PLUGIN-JAVASC

vite-plugin-javascript-obfuscator

devopsjavascriptv3.1.0

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

obfuscatorPlugin

✓ import obfuscatorPlugin from 'vite-plugin-javascript-obfuscator';

✗ import { obfuscatorPlugin } from 'vite-plugin-javascript-obfuscator';

The plugin is exported as a default export.

defineConfig

✓ import { defineConfig } from 'vite';

Required in vite.config.js for type-safe configuration. Not part of this plugin but essential for its usage.

This configuration demonstrates how to integrate `vite-plugin-javascript-obfuscator` into a Vite project, applying comprehensive obfuscation settings to JavaScript/TypeScript files during the build process for enhanced code protection.

import { defineConfig } from 'vite'; import obfuscatorPlugin from 'vite-plugin-javascript-obfuscator'; export default defineConfig({ plugins: [ obfuscatorPlugin({ // Apply obfuscation only during the build process apply: 'build', // Configure files to include (e.g., specific paths or regex) include: ['src/**/*.js', 'src/**/*.jsx', 'src/**/*.ts', 'src/**/*.tsx'], // Basic javascript-obfuscator options for robust protection options: { compact: true, controlFlowFlattening: true, controlFlowFlatteningThreshold: 1, debugProtection: true, debugProtectionInterval: true, disableConsoleOutput: true, identifierNamesGenerator: 'hexadecimal', log: false, numbersToExpressions: true, simplify: true, splitStrings: true, stringArray: true, stringArrayCallsTransform: true, stringArrayCallsTransformThreshold: 1, stringArrayEncoding: ['base64'], stringArrayIndexShift: true, stringArrayRotate: true, stringArrayShuffle: true, stringArrayWrappersCount: 5, stringArrayWrappersType: 'function', stringArrayThreshold: 1, transformObjectKeys: true, unicodeEscapeSequence: true } }) ] });

Debug

Known issues

gotchaExtensive obfuscation, especially with aggressive settings like `debugProtection` or `controlFlowFlattening`, can significantly increase build times and runtime performance overhead. It also makes debugging deployed applications extremely difficult.

fix

Start with lighter obfuscation settings and gradually increase them while thoroughly testing the application after each change. Monitor build performance and runtime impact.

affects: >=1.0.0

gotchaAggressive obfuscation can inadvertently break application functionality, particularly in areas involving reflection, specific string patterns, or third-party libraries that rely on predictable code structure.

fix

Thoroughly test all parts of your application, including edge cases and integrations, after applying obfuscation. Use a staging environment to catch issues before deployment. Utilize the `exclude` option for sensitive files or libraries.

affects: >=1.0.0

gotchaObfuscation does not provide absolute security. While it makes reverse engineering harder, it cannot prevent a determined attacker from eventually understanding or modifying the code. It should be part of a broader security strategy.

fix

Combine obfuscation with other security measures such as server-side validation, secure API design, and regular security audits. Do not rely solely on client-side obfuscation for critical security.

affects: >=1.0.0

deprecatedOlder versions of `javascript-obfuscator` and consequently this plugin might have less effective obfuscation techniques or introduce new vulnerabilities. Always ensure you are using a relatively recent and well-maintained version.

fix

Regularly update `vite-plugin-javascript-obfuscator` and its core dependency `javascript-obfuscator` to benefit from improvements, bug fixes, and updated obfuscation strategies. Review their respective changelogs for breaking changes.

affects: <3.0.0

Errors

Common errors & fixes

Files are not being obfuscated.

The `include` and `exclude` options are not correctly configured, or the `apply` option prevents obfuscation in the current environment (e.g., 'serve' when building).

fix

Verify that `include` patterns correctly match the target files and `exclude` patterns are not overly broad. Ensure `apply` is set to 'build' (for production builds) or omitted (for both serve and build).

Build fails after enabling obfuscation or application throws runtime errors.

Aggressive obfuscation settings (e.g., `debugProtection`, `controlFlowFlattening`) may introduce breaking changes to the application's logic or incompatible syntax.

fix

Start with minimal obfuscation options and gradually enable more aggressive settings, testing thoroughly after each change. Specifically review `javascript-obfuscator` options that might interfere with reflection, string access, or environment-specific code.

ReferenceError: defineConfig is not defined

Missing the necessary import for `defineConfig` in `vite.config.js`.

fix

Add `import { defineConfig } from 'vite';` at the top of your `vite.config.js` file.

Upgrade

Version history

3.1.0latest on npm

Audit

Dependencies

javascript-obfuscatorrequiredCore obfuscation engine used by the plugin.

viterequiredRequired as a peer dependency for Vite plugin functionality.

Agent activity

53 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/elmeet/vite-plugin-javascript-obfuscator ↗

packagehttps://www.npmjs.com/package/vite-plugin-javascript-obfuscator ↗