# Supplementary AST-Based Deobfuscation Materials

> Companion code for the ReverseJS blog's 2022 series on deobfuscating JavaScript by manipulating abstract syntax trees with Babel. Each folder pairs a small obfuscated sample with a deobfuscator script and its output, covering string concealing (escape sequences, concatenation, string arrays and string encryption), constant folding including JSFuck-style code, substitution of constant variables, bracket-to-dot property access, dead-code removal, proxy functions and sequence expressions. The README presents them as short learning examples rather than a production deobfuscator.

- Type: Learning resource
- Targets: Website
- Category: Learning resources
- Relationship: Learning resource
- Sources reviewed: 2026-10-27
- Added to the catalog: 2026-11-03
- Original resource: <https://github.com/SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials>
- Primary source: <https://github.com/SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials/blob/37092955c2ad361364a2162149df9119045de3d0/README.md>
- Catalog page: <https://awesomerea.org/resources/reversejs-ast-deobfuscation-materials/>
- Record JSON: <https://awesomerea.org/resources/reversejs-ast-deobfuscation-materials/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/reversejs-ast-deobfuscation-materials/index.md)

## Requirements & limits

- Reviewed at the 2023-10-20 master commit, whose last change bumped @babel/traverse to 7.23.2. The blog lists seven posts in the series from May and June 2022, and folders such as Proxy Functions and Sequence Expressions have no matching post; the README warns that code not published on the blog is outdated and experimental, may be inaccurate or buggy, will likely not be updated and should not be used in a production deobfuscator.
- Needs Node.js and npm install: package.json declares @babel/core and js-beautify, and the lockfile resolves @babel/parser, @babel/traverse and @babel/generator 7.23.x. Each script is run with node from its folder against the bundled sample. The String Encryption example also imports chrome-remote-interface-extra, which package.json does not list.
- The samples are short, author-written obfuscations, so applying the techniques to other code needs the analyst's own inputs and checking. The VM-evaluation proxy-function example and the String Encryption example run code from the sample through Node's vm module, which Node.js documents as not a security mechanism. The author's later blog post reports CVE-2023-45133, an arbitrary-code-execution flaw in @babel/traverse before 7.23.2; the reviewed lockfile already resolves 7.23.2.
- There are no tests or CI (the npm test script is a placeholder); expected outputs are committed beside each sample.
- MIT (LICENSE), although package.json keeps npm's default ISC field.

## Primary sources

1. <https://github.com/SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials/blob/37092955c2ad361364a2162149df9119045de3d0/README.md>
2. <https://github.com/SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials/blob/37092955c2ad361364a2162149df9119045de3d0/package.json>
3. <https://github.com/SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials/blob/37092955c2ad361364a2162149df9119045de3d0/package-lock.json>
4. <https://github.com/SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials/tree/37092955c2ad361364a2162149df9119045de3d0/String%20Concealing>
5. <https://github.com/SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials/tree/37092955c2ad361364a2162149df9119045de3d0/Proxy%20Functions>
6. <https://github.com/SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials/blob/37092955c2ad361364a2162149df9119045de3d0/String%20Concealing/String%20Encryption/deobber.js>
7. <https://github.com/SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials/blob/37092955c2ad361364a2162149df9119045de3d0/LICENSE>
8. <https://steakenthusiast.github.io/2022/05/21/Deobfuscating-Javascript-via-AST-An-Introduction-to-Babel/>
9. <https://steakenthusiast.github.io/2023/10/11/CVE-2023-45133-Finding-an-Arbitrary-Code-Execution-Vulnerability-In-Babel/>
10. <https://github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92>
11. <https://nodejs.org/api/vm.html>

## More in References and learning

- [MCP Reversing Dataset (mrexodia)](https://awesomerea.org/resources/mcp-reversing-dataset/index.md) · Learning resource
- [ICSim (Instrument Cluster Simulator)](https://awesomerea.org/resources/icsim/index.md) · Learning resource
- [CNNPRE (IEEE Access 2023)](https://awesomerea.org/resources/cnnpre/index.md) · Research
- [RPISEC Malware Analysis course (CSCI 4976)](https://awesomerea.org/resources/rpisec-malware-analysis-course/index.md) · Learning resource
- [Corkami pics](https://awesomerea.org/resources/corkami-pics/index.md) · Learning resource
- [Practical Malware Analysis](https://awesomerea.org/resources/practical-malware-analysis/index.md) · Learning resource

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.