js-virtualizer

1.0.2 verified Fri May 01 auth: no javascript

A proof-of-concept JavaScript obfuscation tool that converts individual functions into bytecode executed by a custom virtual machine (VM) written in JavaScript. Version 1.0.2 is the current and only release. The transpiler converts functions marked with `// @virtualize` into opcodes for the VM. Key differentiators: unlike traditional obfuscators that rename/transform AST, this executes code in an interpreted VM, making reverse engineering significantly harder. Not intended for whole programs due to performance overhead; targets server-side Node.js, not browsers. Development appears stalled (no updates since initial release).

Common errors

error Error: The code does not contain any // @virtualize comments. ↓

cause No functions were marked with the required comment, so the transpiler produces no output.

fix

Add // @virtualize as a comment line immediately before the function declaration you want to virtualize.

error TypeError: Cannot read properties of undefined (reading 'code') ↓

cause Running transpile() without await may return a Promise object instead of the result object.

fix

Use await or .then() to handle the asynchronous transpile() call.

error Error: The virtualized function uses 'this' incorrectly. ↓

cause The VM does not support a function accessing its own 'this' property. Arrow functions or methods may fail.

fix

Refactor the virtualized function to avoid relying on 'this'. Use explicit parameters or bind the context outside.

Warnings

gotcha Only functions marked with // @virtualize comment are transpiled. Other code is left as-is, which can lead to mixed code that may not execute correctly. ↓

fix Ensure all functions that should be virtualized have the exact comment // @virtualize on the line immediately above the function declaration.

gotcha Virtualizing an entire program or large functions will cause severe performance degradation. The VM is designed for small, isolated functions only. ↓

fix Only use // @virtualize on small, critical functions. Test performance impact before production.

gotcha Async functions running concurrently are not supported. The VM executes asynchronous operations sequentially. ↓

fix Avoid using concurrent async functions inside virtualized code. Use sequential awaits or callbacks.

gotcha The package is intended for Node.js server-side only. It uses require() internally and has not been tested in browsers. ↓

fix If using in a browser, replace require() calls in vm_dist.js with browser-compatible imports (e.g., ES modules or window globals).

gotcha The default VM file (vm_dist.js) includes opcode names in plain text, making reverse engineering easier. It is recommended to modify and obfuscate this file before production use. ↓

fix Edit src/vm_dist.js to rename opcode identifiers and apply obfuscation to the VM itself.

deprecated This project appears to be a proof-of-concept with no updates since initial release. The API may not be stable. ↓

fix For production obfuscation, consider alternatives like jscrambler, javascript-obfuscator, or commercial solutions. Maintain your own fork if needed.

Install

npm install js-virtualizer

yarn add js-virtualizer

pnpm add js-virtualizer

Imports

transpile

wrong

const transpile = require('js-virtualizer').transpile

correct

import { transpile } from 'js-virtualizer'

Both ESM and CJS are supported. The package exports transpile as a named export.

VM
wrong
```
const jsVirtualizer = require('js-virtualizer'); const VM = jsVirtualizer.VM;
```
correct
```
import { VM } from 'js-virtualizer'
```
VM is the virtual machine class. It is exported as a named export but rarely used directly – transpile() generates code that uses VM internally.
execute
```
import { execute } from 'js-virtualizer'
```
execute function is not part of the public API. It is an internal detail. Use transpile() instead.

Quickstart

Demonstrates transpiling a simple virtualized function with multiple passes, writing output to files, and handling configuration options.

const { transpile } = require('js-virtualizer');

async function main() {
  const code = `
    // @virtualize
    function add(a, b) {
      return a + b;
    }
    add(1, 2);
  `;

  const result = await transpile(code, {
    fileName: 'example',
    writeOutput: false,
    vmOutputPath: './vm_output.js',
    transpiledOutputPath: './output.js',
    passes: ['RemoveUnused', 'ObfuscateVM', 'ObfuscateTranspiled']
  });

  console.log('Transpiled code:', result.code);
}

main().catch(console.error);