{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/echo094/decode-js/blob/ca4690abacd3dc3666363769a7e846758e7311e9/package.json",
    "https://github.com/echo094/decode-js/blob/ca4690abacd3dc3666363769a7e846758e7311e9/docs/jsconfuser.md",
    "https://github.com/echo094/decode-js/blob/ca4690abacd3dc3666363769a7e846758e7311e9/src/main.js",
    "https://github.com/echo094/decode-js/blob/ca4690abacd3dc3666363769a7e846758e7311e9/src/plugin/eval.js",
    "https://github.com/echo094/decode-js/blob/ca4690abacd3dc3666363769a7e846758e7311e9/src/plugin/obfuscator.js",
    "https://github.com/echo094/decode-js/blob/ca4690abacd3dc3666363769a7e846758e7311e9/src/visitor/obfuscator/string-array.js",
    "https://github.com/echo094/decode-js/tree/ca4690abacd3dc3666363769a7e846758e7311e9/test",
    "https://github.com/echo094/decode-js/blob/ca4690abacd3dc3666363769a7e846758e7311e9/.github/workflows/test.yml",
    "https://github.com/echo094/decode-js/blob/ca4690abacd3dc3666363769a7e846758e7311e9/LICENSE"
  ],
  "category": "web-analysis",
  "description_en": "Babel-based AST processor that turns obfuscated JavaScript back into readable source, with one target selected per run: javascript-obfuscator (obfuscator.io), JS-Confuser 2.x up to its high preset, sojson and its v7 variant for jsjiami.com.v7, sojson's jjencode variant, and a generic pass for unreachable code, nested blocks and constant expressions. A second, version-aware obfuscator.io target reports the encoder era it detects and returns nothing, with a reason, rather than a half-decoded program when a string-array layer cannot be read. The JS-Confuser notes list each transform it reverses and those, such as variable renaming, that destroy information and cannot be recovered.",
  "description_zh": "基于 Babel AST 的处理工具，可把混淆过的 JavaScript 还原为可读源码，每次运行选择一个目标：javascript-obfuscator（obfuscator.io）、JS-Confuser 2.x（直至 high 预设）、sojson 及其面向 jsjiami.com.v7 的 v7 变体、sojson 风格的 jjencode，以及处理不可达代码、嵌套代码块和常量表达式的通用目标。另一个按版本区分的 obfuscator.io 目标会报告检测到的编码器版本区间；遇到无法读取的字符串数组层时，它不输出结果并说明原因，而不是给出解了一半的程序。JS-Confuser 文档逐项列出可还原的变换，以及变量重命名等会丢失信息、无法恢复的变换。",
  "entry_url": "https://awesomerea.org/resources/decode-js/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/decode-js/",
  "evidence_url": "https://github.com/echo094/decode-js/blob/ca4690abacd3dc3666363769a7e846758e7311e9/README.md",
  "group": "tools",
  "id": "decode-js",
  "json_url": "https://awesomerea.org/resources/decode-js/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/decode-js/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/decode-js/index.md",
  "name": "decode-js",
  "name_zh": "decode-js JavaScript 反混淆 AST 工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "No releases or tags are published; the reviewed main commit of 2026-10-17 runs from source. package.json requires Node.js 26.x to match its native isolated-vm 7 dependency, whose build requirements the README asks users to check first. After npm i, the CLI runs as npm run decode -- -t <target> with optional input and output paths, or through shortcuts such as deob, deobx, dejsc, deso and desov7.",
    "Input is a single obfuscated script, input.js by default, and the README says the file must not contain other, non-obfuscated code. Coverage depends on the obfuscator and its version: the version-aware target covers the javascript-obfuscator 2.x eras and 5.5.0, leaves 3.0.0–4.2.2 unverified and reports samples in that range as unknown, and the JS-Confuser target cannot restore RenameVariables, RenameLabels or ObjectExtraction.",
    "Decoding evaluates parts of the input: string-array decoders and JS-Confuser runtime helpers run inside isolated-vm sandboxes, but the obfuscator, sojson and sojsonv7 targets unpack an outer eval wrapper with Node.js eval in the decoder's own process. Treat inputs as untrusted code, and check recovered strings and control flow against the original script.",
    "CI runs the Vitest suite on Node.js 26; its fixtures pair obfuscated samples, mostly generated from included source files, with expected decodes for the JS-Confuser, obfuscator.io and sojson v7 targets. GPL-3.0-or-later per the README, LICENSE and package.json."
  ],
  "requirements_zh": [
    "仓库未发布 Release 或标签；所审阅的 main 分支提交日期为 2026-10-17，需从源码运行。package.json 要求 Node.js 26.x，以配合原生依赖 isolated-vm 7；README 提醒先查看 isolated-vm 的构建要求。执行 npm i 后，可通过 npm run decode -- -t <目标> 运行命令行工具，并可指定输入和输出路径，也可使用 deob、deobx、dejsc、deso、desov7 等快捷命令。",
    "输入为单个混淆脚本，默认是 input.js；README 说明该文件中不能夹杂其他未混淆的代码。适用范围取决于混淆器及其版本：按版本区分的目标覆盖 javascript-obfuscator 2.x 各阶段和 5.5.0，3.0.0–4.2.2 尚未验证，落在该区间的样本会报告为未知；JS-Confuser 目标无法还原 RenameVariables、RenameLabels 和 ObjectExtraction。",
    "解码时会执行输入中的部分代码：字符串数组解码函数和 JS-Confuser 运行时辅助函数在 isolated-vm 沙箱中运行，但 obfuscator、sojson 和 sojsonv7 目标会在解码器自身进程中用 Node.js 的 eval 解开最外层的 eval 包装。应把输入视为不受信任的代码，还原出的字符串和控制流也需对照原始脚本核实。",
    "CI 在 Node.js 26 上运行 Vitest 测试套件；测试样例针对 JS-Confuser、obfuscator.io 和 sojson v7 目标，把混淆样本（大多由仓库内附的源文件生成）与预期解码结果配对。README、LICENSE 和 package.json 均声明 GPL-3.0-or-later。"
  ],
  "targets": [
    "website"
  ],
  "url": "https://github.com/echo094/decode-js",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}