{"id":12666,"library":"webpack-obfuscator","title":"Webpack Obfuscator Plugin and Loader","description":"webpack-obfuscator is a JavaScript Obfuscator plugin and loader designed specifically for Webpack 5 and above. It integrates the robust `javascript-obfuscator` library into the Webpack build process, allowing developers to protect their JavaScript code by making it harder to read and reverse-engineer. The current stable version is 3.6.1. Releases appear to be frequent, focusing on dependency updates and minor enhancements, indicating an active maintenance schedule. A key differentiator is its seamless integration as both a Webpack plugin and a loader, offering flexibility in how obfuscation is applied, including the ability to exclude specific bundles or files. It also supports the obfuscator.io Pro API for advanced, cloud-based obfuscation techniques, requiring `javascript-obfuscator` version 5.0.0 or higher for this feature.","status":"active","version":"3.6.1","language":"javascript","source_language":"en","source_url":"https://github.com/javascript-obfuscator/webpack-obfuscator","tags":["javascript","obfuscator","obfuscation","uglify","crush","code protection","javascript obfuscator","js obfuscator","webpack obfuscator","typescript"],"install":[{"cmd":"npm install webpack-obfuscator","lang":"bash","label":"npm"},{"cmd":"yarn add webpack-obfuscator","lang":"bash","label":"yarn"},{"cmd":"pnpm add webpack-obfuscator","lang":"bash","label":"pnpm"}],"dependencies":[{"reason":"Core obfuscation engine. Must be installed separately as a peer dependency.","package":"javascript-obfuscator","optional":false},{"reason":"Required for Webpack 5 integration. This plugin is not compatible with Webpack 4 or older.","package":"webpack","optional":false}],"imports":[{"note":"While the README shows `require()`, for modern Webpack configurations and TypeScript, ESM `import` is preferred. The package ships with types.","wrong":"const WebpackObfuscator = require('webpack-obfuscator');","symbol":"WebpackObfuscator","correct":"import WebpackObfuscator from 'webpack-obfuscator';"},{"note":"The loader reference is a property of the default export, not a named export.","wrong":"import { loader } from 'webpack-obfuscator';\n// The loader is a static property on the default export.","symbol":"WebpackObfuscator.loader","correct":"import WebpackObfuscator from 'webpack-obfuscator';\n// then use WebpackObfuscator.loader"},{"note":"When using TypeScript, import `WebpackObfuscator` as a default import. Webpack configuration types can be imported from `webpack`.","symbol":"WebpackObfuscator Plugin Usage (TypeScript)","correct":"import WebpackObfuscator from 'webpack-obfuscator';\n\nconst config: Configuration = {\n  // ...\n  plugins: [\n    new WebpackObfuscator({ rotateStringArray: true }, ['excluded_bundle_name.js'])\n  ]\n};"}],"quickstart":{"code":"const path = require('path');\nconst WebpackObfuscator = require('webpack-obfuscator');\n\nmodule.exports = {\n    mode: 'production',\n    entry: {\n        'main': './src/index.js'\n    },\n    output: {\n        path: path.resolve(__dirname, 'dist'),\n        filename: '[name].js'\n    },\n    plugins: [\n        new WebpackObfuscator({\n            rotateStringArray: true,\n            stringArrayThreshold: 0.75\n        }, ['main.js'])\n    ],\n    module: {\n        rules: [\n            {\n                test: /\\.js$/,\n                exclude: /node_modules/,\n                enforce: 'post',\n                use: {\n                    loader: WebpackObfuscator.loader,\n                    options: {\n                        compact: true\n                    }\n                }\n            }\n        ]\n    }\n};","lang":"javascript","description":"Demonstrates a basic Webpack configuration applying `webpack-obfuscator` as both a plugin (for global bundle obfuscation with exclusions) and a loader (for individual file obfuscation before other loaders, using `enforce: 'post'`)."},"warnings":[{"fix":"Upgrade to Webpack 5 or higher, or downgrade `webpack-obfuscator` to a 2.x release if tied to Webpack 4.","message":"Version 3.0.0 and higher of `webpack-obfuscator` are only compatible with Webpack 5 and above. Older Webpack versions (e.g., Webpack 4) require `webpack-obfuscator` version 2.x.","severity":"breaking","affected_versions":">=3.0.0"},{"fix":"Ensure `javascript-obfuscator` is installed: `npm install --save-dev javascript-obfuscator`.","message":"Starting with version 3.0.0, `javascript-obfuscator` is a peer dependency and must be installed explicitly alongside `webpack-obfuscator`. Previously, it was a direct dependency.","severity":"breaking","affected_versions":">=3.0.0"},{"fix":"Verify `javascript-obfuscator` version in `package.json` and update if necessary (`npm install javascript-obfuscator@latest`).","message":"Using the Pro API for cloud-based obfuscation requires `javascript-obfuscator` version 5.0.0 or higher. Ensure your `javascript-obfuscator` peer dependency meets this requirement if you intend to use Pro API features.","severity":"gotcha","affected_versions":">=3.0.0"},{"fix":"Add `enforce: 'post'` to the loader rule in your webpack configuration: `{ test: /\\.js$/, enforce: 'post', use: { loader: WebpackObfuscator.loader, ... } }`.","message":"When using the loader, it's recommended to add `enforce: 'post'` to your webpack rule. This ensures the obfuscator loader runs after all other normal loaders, preventing potential conflicts or issues where other loaders might interfere with the obfuscation process.","severity":"gotcha","affected_versions":">=3.0.0"},{"fix":"For the plugin, ensure `excludes` array matches your compiled bundle names (e.g., `['my-bundle.js']`). For the loader, use `path.resolve(__dirname, 'src/excluded-file.js')`.","message":"The `excludes` option for the plugin takes bundle names (output file names), not source file names. When using `[name].js` in webpack's output, these are the names to exclude. For the loader, `exclude` takes source file paths.","severity":"gotcha","affected_versions":">=3.0.0"}],"env_vars":null,"last_verified":"2026-04-19T00:00:00.000Z","next_check":"2026-07-18T00:00:00.000Z","problems":[{"fix":"For CommonJS, `const WebpackObfuscator = require('webpack-obfuscator');` is shown in the README. For ESM, use `import WebpackObfuscator from 'webpack-obfuscator';`","cause":"Incorrect import statement (e.g., using named import for a default export) or trying to `require` a pure ESM package.","error":"TypeError: WebpackObfuscator is not a constructor"},{"fix":"Install the peer dependency: `npm install --save-dev javascript-obfuscator`.","cause":"The `javascript-obfuscator` package, a peer dependency, is not installed.","error":"Error: Cannot find module 'javascript-obfuscator'"},{"fix":"When using `WebpackObfuscator.loader`, options should be nested under `options` in the `use` object: `{ use: { loader: WebpackObfuscator.loader, options: { rotateStringArray: true } } }`.","cause":"Attempting to pass loader options directly to the `WebpackObfuscator` plugin constructor without nesting them under `options` for the loader itself, or mistaking plugin usage for loader usage.","error":"Error: The 'options' property is only allowed for 'plugins' with a 'tap' hook"},{"fix":"Downgrade `webpack-obfuscator` to a 2.x version (e.g., `npm install webpack-obfuscator@^2.0.0 --save-dev`) or upgrade your project to Webpack 5.","cause":"Using `webpack-obfuscator` v3.x with Webpack 4, which is incompatible.","error":"Webpack compilation fails or code is not obfuscated as expected (Webpack 4 user)"}],"ecosystem":"npm"}