{
  "added_at": "2026-11-03",
  "additional_evidence_urls": [
    "https://github.com/1egoman/debundle/blob/67531ffe13c3a78db08b51dd37f7ba9c4f77e98c/DOCS.md",
    "https://github.com/1egoman/debundle/blob/67531ffe13c3a78db08b51dd37f7ba9c4f77e98c/package.json",
    "https://github.com/1egoman/debundle/blob/67531ffe13c3a78db08b51dd37f7ba9c4f77e98c/.travis.yml",
    "https://github.com/1egoman/debundle/blob/67531ffe13c3a78db08b51dd37f7ba9c4f77e98c/src/decoders/webpack.js",
    "https://github.com/1egoman/debundle/tree/67531ffe13c3a78db08b51dd37f7ba9c4f77e98c/test_bundles",
    "https://github.com/1egoman/debundle/blob/67531ffe13c3a78db08b51dd37f7ba9c4f77e98c/test_bundles/run_test.sh",
    "https://github.com/1egoman/debundle/blob/67531ffe13c3a78db08b51dd37f7ba9c4f77e98c/src/extern/replace-method/LICENSE.md",
    "https://www.npmjs.com/package/debundle/v/0.5.4"
  ],
  "category": "web-analysis",
  "description_en": "Node.js command-line tool that unpacks JavaScript bundles produced by Browserify or Webpack back into a tree of module files, so a bundle can be read file by file instead of as one script. A JSON configuration gives the bundle type, the entry-point module and optional knownPaths that map numeric module IDs to output files or node_modules packages, and it can rewrite a minifier's renamed require identifier inline or through a variable so the output can be rebundled or run in Node. The README says it was built to learn how bundles are structured for a reverse-engineering project and that debundling is lossy: package.json settings and Webpack module names are not recovered, and minified code stays minified.",
  "description_zh": "Node.js 命令行工具，可把 Browserify 或 Webpack 生成的 JavaScript 打包文件还原为按模块拆分的文件树，便于逐个文件阅读，而不必面对一整个脚本。JSON 配置文件指定打包类型、入口模块，以及可选的 knownPaths（把数字模块 ID 映射为输出文件或 node_modules 中的包路径）；它还能以内联或变量方式改写被压缩工具重命名的 require 标识符，使输出可重新打包或在 Node 中运行。README 称该工具是作者为一个逆向工程项目了解打包结构而编写的，并指出拆包是有损的：无法恢复 package.json 设置和 Webpack 模块名称，压缩过的代码拆出后仍是压缩状态。",
  "entry_url": "https://awesomerea.org/resources/debundle/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/debundle/",
  "evidence_url": "https://github.com/1egoman/debundle/blob/67531ffe13c3a78db08b51dd37f7ba9c4f77e98c/README.md",
  "group": "tools",
  "id": "debundle",
  "json_url": "https://awesomerea.org/resources/debundle/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/debundle/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/debundle/index.md",
  "name": "debundle",
  "name_zh": "debundle JavaScript 打包文件拆包工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "The README calls this a research project that is no longer maintained and says it works in a laboratory environment most of the time but often fails on real-world bundles. The reviewed master commit dates from 2018-06-16; npm's latest debundle release is 0.5.4 of 2017-09-12, newer than the repository's v0.5.3 tag and package.json, and unfinished v2 branches were last updated in 2020.",
    "Installs with npm i -g debundle and runs as debundle -i <bundle> -o <directory> -c <config>. package.json requires Node 6 or newer, .nvmrc and the Travis CI configuration use Node 6, and the dependencies date from that period, such as acorn 4 and recast 0.5.",
    "Only Browserify bundles and Webpack bundles whose modules are passed as an array are decoded: the Webpack decoder aborts when the module list is not an array, and other bundlers are not officially supported, although the moduleAst option can point to a module list with the same layout. Webpack output files are named after module IDs unless knownPaths names them.",
    "test_bundles/ holds four small sample bundles with their configurations and original sources, which CI debundles with test_bundles/run_test.sh; the comparison with the original sources is commented out, so CI only checks that debundling finishes. Users supply the bundles to unpack, and the README's legal note warns that some terms of service forbid reverse engineering.",
    "package.json and the npm package declare ISC, but the repository has no license file and GitHub detects none; src/extern/replace-method is a vendored MIT-licensed module by Hugh Kennedy."
  ],
  "requirements_zh": [
    "README 称这是一个已不再维护的研究项目，在实验环境中大多能正常工作，但处理真实环境中的打包文件时经常失败。所审阅的 master 提交日期为 2018-06-16；npm 上 debundle 的最新版本是 2017-09-12 发布的 0.5.4，比仓库的 v0.5.3 标签和 package.json 中的版本更新；未完成的 v2 分支最后更新于 2020 年。",
    "通过 npm i -g debundle 安装，运行方式为 debundle -i <打包文件> -o <输出目录> -c <配置文件>。package.json 要求 Node 6 及以上，.nvmrc 和 Travis CI 配置使用 Node 6，依赖也是同一时期的版本，如 acorn 4 和 recast 0.5。",
    "只能解析 Browserify 打包文件，以及以数组形式传入模块的 Webpack 打包文件：模块列表不是数组时 Webpack 解码器会中止；其他打包工具未获官方支持，但可用 moduleAst 选项指向布局相同的模块列表。除非在 knownPaths 中指定名称，Webpack 拆出的文件以模块 ID 命名。",
    "test_bundles/ 目录包含四个小型示例打包文件及其配置和原始源码，CI 通过 test_bundles/run_test.sh 对它们执行拆包；与原始源码比对的部分已被注释掉，因此 CI 只检查拆包能否完成。待拆包的文件需由用户自备，README 的法律提示还提醒，部分服务条款禁止逆向工程。",
    "package.json 和 npm 软件包声明采用 ISC 许可，但仓库没有许可证文件，GitHub 也未识别出许可证；src/extern/replace-method 是随附的 MIT 许可模块，作者为 Hugh Kennedy。"
  ],
  "targets": [
    "website"
  ],
  "url": "https://github.com/1egoman/debundle",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}