{
  "added_at": "2026-11-03",
  "additional_evidence_urls": [
    "https://github.com/0x1Avram/js-deobfuscator/blob/3a4a20ab0d107d168bbef14105c35970c59e4eae/package.json",
    "https://github.com/0x1Avram/js-deobfuscator/blob/3a4a20ab0d107d168bbef14105c35970c59e4eae/deobfuscator.js",
    "https://github.com/0x1Avram/js-deobfuscator/blob/3a4a20ab0d107d168bbef14105c35970c59e4eae/Stages/stage_09_preparing.js",
    "https://github.com/0x1Avram/js-deobfuscator/blob/3a4a20ab0d107d168bbef14105c35970c59e4eae/Stages/stage_03_stringarray.js",
    "https://github.com/0x1Avram/js-deobfuscator/blob/3a4a20ab0d107d168bbef14105c35970c59e4eae/Stages/stage_04_renameidentifiers.js",
    "https://github.com/0x1Avram/js-deobfuscator/tree/3a4a20ab0d107d168bbef14105c35970c59e4eae/Examples",
    "https://github.com/0x1Avram/js-deobfuscator/blob/3a4a20ab0d107d168bbef14105c35970c59e4eae/LICENSE",
    "https://github.com/0x1Avram/js-deobfuscator/releases/tag/1.0.7"
  ],
  "category": "web-analysis",
  "description_en": "Node.js deobfuscator for JavaScript produced by Timofey Kachalov's javascript-obfuscator, also offered as obfuscator.io. It parses the sample with esprima and runs eleven stages named after the obfuscator's own, which remove injected self-defending and debug-protection code, unwind control-flow flattening and dead-code injection, restore converted literals and object keys, replace string-array calls with the decoded strings, simplify the result and recursively process code passed to eval. String-array code is detected automatically or supplied as separate files, and an Examples folder pairs original, obfuscated and deobfuscated samples.",
  "description_zh": "面向 Timofey Kachalov 的 javascript-obfuscator（亦以 obfuscator.io 提供）所生成 JavaScript 的 Node.js 反混淆工具。它用 esprima 解析样本，依次运行十一个与该混淆器同名的阶段：移除注入的自我防护和调试保护代码，还原控制流平坦化和死代码注入，恢复被转换的字面量和对象键，把字符串数组调用替换为解码后的字符串，化简结果，并对传给 eval 的代码递归处理。字符串数组相关代码可自动识别，也可拆成单独文件输入；Examples 目录收录了原始、混淆后和反混淆后的成对样本。",
  "entry_url": "https://awesomerea.org/resources/0x1avram-js-deobfuscator/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/0x1avram-js-deobfuscator/",
  "evidence_url": "https://github.com/0x1Avram/js-deobfuscator/blob/3a4a20ab0d107d168bbef14105c35970c59e4eae/README.md",
  "group": "tools",
  "id": "0x1avram-js-deobfuscator",
  "json_url": "https://awesomerea.org/resources/0x1avram-js-deobfuscator/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/0x1avram-js-deobfuscator/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/0x1avram-js-deobfuscator/index.md",
  "name": "JS-Deobfuscator (0x1Avram)",
  "name_zh": "JS-Deobfuscator（0x1Avram）Obfuscator.io 反混淆工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Inactive since the reviewed main commit, a README update on 2023-04-17. The last release, 1.0.7 (2022-12-29), attaches binaries.zip with standalone Windows and Linux builds made with pkg, while package.json still reports 1.0.2. The README says it was developed with Node.js 16.15 and worked with obfuscator versions current at the time; output from older obfuscator versions may produce a different AST.",
    "Run from source after npm install (esprima, escodegen, esquery, estraverse, winston and yargs) with node index.js -i input -o output. When automatic detection fails, the string array, its wrappers, the wrapper names and the rotate code are passed as separate files with -s, -w, -n and -r. esprima does not parse all newer JavaScript syntax, so the README suggests transpiling such input with Babel first.",
    "The README warns that the code is not secure and should run only in an isolated environment such as a virtual machine: string-array decoding evaluates code taken from the sample with eval inside the deobfuscator's own Node.js process. The identifier- and property-renaming stages are empty placeholders, so obfuscated names are not recovered.",
    "Supply the obfuscated script yourself. The Examples text files are derived from small snippets, javascript-obfuscator's example script (BSD-2-Clause) and javascript-algorithms (MIT), with both licenses included.",
    "MIT (LICENSE). A different project from ben-sb javascript-deobfuscator, whose npm package is also named js-deobfuscator; this one is used from its repository or release binaries."
  ],
  "requirements_zh": [
    "自所审阅的 main 分支提交（2023-04-17 的 README 更新）以来没有新的提交。最后一个版本 1.0.7（2022-12-29）附带 binaries.zip，内含用 pkg 构建的独立 Windows 和 Linux 程序，而 package.json 中的版本号仍为 1.0.2。README 称开发时使用 Node.js 16.15，并适用于当时的混淆器版本；旧版混淆器的输出可能生成不同的 AST。",
    "从源码运行需先执行 npm install（依赖 esprima、escodegen、esquery、estraverse、winston 和 yargs），再用 node index.js -i 输入 -o 输出 调用。自动识别失败时，需用 -s、-w、-n 和 -r 分别以单独文件传入字符串数组、其包装函数、包装函数名和轮转代码。esprima 无法解析所有较新的 JavaScript 语法，README 建议先用 Babel 转译这类输入。",
    "README 警告该代码并不安全，只应在虚拟机等隔离环境中运行：解码字符串数组时，会在反混淆工具自身的 Node.js 进程中用 eval 执行从样本中取出的代码。标识符和属性重命名阶段只是空的占位实现，因此不会恢复被混淆的名称。",
    "需自行提供待分析的混淆脚本。Examples 中的文本文件取自简短代码片段、javascript-obfuscator 的示例脚本（BSD-2-Clause）和 javascript-algorithms（MIT），并附有这两份许可证。",
    "MIT 许可证（LICENSE）。它与 ben-sb javascript-deobfuscator 是不同项目，后者的 npm 包同样名为 js-deobfuscator；本项目需从仓库或发布版程序使用。"
  ],
  "targets": [
    "website"
  ],
  "url": "https://github.com/0x1Avram/js-deobfuscator",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}