# sourcemapper

> Go command-line tool that recreates a web front end's original JavaScript source tree from a source map generated by webpack or a similar bundler, writing each embedded source file under the path the map records. It takes a .map file by URL or local path, walks a directory of .map files, or fetches a JavaScript file and follows its sourceMappingURL comment or SourceMap response header, including inline data: maps.

- Type: Tool
- Targets: Website
- Category: Website analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-19
- Added to the catalog: 2026-10-30
- Original resource: <https://github.com/denandz/sourcemapper>
- Primary source: <https://github.com/denandz/sourcemapper/blob/f739bd5dd266b0d0e2cfa17c0a132f79bd9a5ba9/README.md>
- Catalog page: <https://awesomerea.org/resources/sourcemapper/>
- Record JSON: <https://awesomerea.org/resources/sourcemapper/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/sourcemapper/index.md)

## Requirements & limits

- The project publishes no releases or tags. The README installs it with go install, a clone-and-build, or the BlackArch package; go.mod declares Go 1.16 and lists no third-party modules. The reviewed master commit, dated 2026-07-24, also adds the -dir batch mode and refuses to read a local path named by a remote sourceMappingURL.
- Only one of -url, -jsurl or -dir is accepted per run, and -output is required. Remote fetches can carry extra request headers, go through a proxy or skip TLS verification. The README warns that a JavaScript file parsed with -jsurl can make sourcemapper send a GET request to any URL it names as its source map.
- The input is a source map the user may inspect. The tool reads only the map's version, sources and sourcesContent fields, so maps without embedded sourcesContent are rejected and minified bundles without a map are out of scope; the mappings are not used, and output is the bundler's captured source text, not code verified against the deployed bundle.
- BSD-3-Clause. Recovered front-end code remains subject to the site owner's rights. The README links a 2018 Pulse Security article describing its use for front-end source review in a penetration test.

## Primary sources

1. <https://github.com/denandz/sourcemapper/blob/f739bd5dd266b0d0e2cfa17c0a132f79bd9a5ba9/README.md>
2. <https://github.com/denandz/sourcemapper/blob/f739bd5dd266b0d0e2cfa17c0a132f79bd9a5ba9/README.md#L124>
3. <https://github.com/denandz/sourcemapper/blob/f739bd5dd266b0d0e2cfa17c0a132f79bd9a5ba9/main.go#L22-L28>
4. <https://github.com/denandz/sourcemapper/blob/f739bd5dd266b0d0e2cfa17c0a132f79bd9a5ba9/main.go#L290-L327>
5. <https://github.com/denandz/sourcemapper/blob/f739bd5dd266b0d0e2cfa17c0a132f79bd9a5ba9/go.mod>
6. <https://github.com/denandz/sourcemapper/blob/f739bd5dd266b0d0e2cfa17c0a132f79bd9a5ba9/LICENSE>
7. <https://pulsesecurity.co.nz/articles/javascript-from-sourcemaps>

## More in Websites

- [ngrev](https://awesomerea.org/resources/ngrev/index.md) · Tool
- [jsluice](https://awesomerea.org/resources/jsluice/index.md) · Tool
- [REstringer](https://awesomerea.org/resources/restringer/index.md) · Tool
- [Chrome extension source viewer (CRX Viewer)](https://awesomerea.org/resources/crxviewer/index.md) · Tool
- [har-to-openapi](https://awesomerea.org/resources/har-to-openapi/index.md) · Tool
- [decode-js](https://awesomerea.org/resources/decode-js/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.