{
  "added_at": "2026-10-29",
  "additional_evidence_urls": [
    "https://github.com/relative/synchrony/blob/710e9f6c21ceea0cddf178eb863ef678f5d9d6ee/package.json",
    "https://github.com/relative/synchrony/blob/710e9f6c21ceea0cddf178eb863ef678f5d9d6ee/src/cli.js",
    "https://github.com/relative/synchrony/blob/710e9f6c21ceea0cddf178eb863ef678f5d9d6ee/src/deobfuscator.ts",
    "https://github.com/relative/synchrony/blob/710e9f6c21ceea0cddf178eb863ef678f5d9d6ee/src/context.ts",
    "https://github.com/relative/synchrony/blob/710e9f6c21ceea0cddf178eb863ef678f5d9d6ee/src/transformers/stringdecoder.ts",
    "https://github.com/relative/synchrony/blob/710e9f6c21ceea0cddf178eb863ef678f5d9d6ee/LICENSE.md",
    "https://github.com/relative/synchrony/releases/tag/2.4.6"
  ],
  "category": "web-analysis",
  "description_en": "JavaScript cleaner and deobfuscator aimed mainly at output from javascript-obfuscator (obfuscator.io). It parses a script with acorn and runs a fixed pipeline of AST transformers that fold expressions, clean member accesses, remove dead branches, split sequence expressions, undo switch-based control-flow flattening and decode string arrays, re-implementing their base64 and RC4 decoders in TypeScript rather than executing the input. It ships on npm as deobfuscator with a synchrony CLI and a library API, and optional renaming replaces identifiers with generated word names rather than recovering the originals.",
  "description_zh": "主要面向 javascript-obfuscator（obfuscator.io）输出的 JavaScript 清理与反混淆工具。它用 acorn 解析脚本，再运行一组固定的 AST 转换器：折叠表达式、整理成员访问、删除死分支、拆分逗号表达式、还原基于 switch 的控制流平坦化，并解码字符串数组；其中 base64 和 RC4 解码器以 TypeScript 重新实现，而不是执行输入代码。它以 deobfuscator 之名发布在 npm 上，提供 synchrony 命令行工具和库 API；可选的重命名会把标识符换成生成的单词名，并不能恢复原名。",
  "entry_url": "https://awesomerea.org/resources/synchrony/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/synchrony/",
  "evidence_url": "https://github.com/relative/synchrony/blob/710e9f6c21ceea0cddf178eb863ef678f5d9d6ee/README.md",
  "group": "tools",
  "id": "synchrony",
  "json_url": "https://awesomerea.org/resources/synchrony/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/synchrony/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/synchrony/index.md",
  "name": "synchrony",
  "name_zh": "synchrony JavaScript 反混淆工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: 2.4.6, published to GitHub and to npm as deobfuscator on 2026-07-07, the same day as the reviewed master commit; the previous release, 2.4.5, dates from 2023-11-09. The README also points to a hosted web version at deobfuscate.relative.im.",
    "Install with npm, yarn or pnpm, or from the Git repository; package.json declares no Node.js version. The CLI reads one file, writes <name>.cleaned.<ext> unless --output is given, and offers --rename, --loose parsing, --ecma-version and --sourceType. A --config file is loaded with Node's require, so it runs as code, and a custom transformer list replaces the default pipeline; two jsconfuser transformers are available only that way and are not documented in the README.",
    "The README warns that output from old javascript-obfuscator versions will likely not deobfuscate correctly and that there is no user configuration for the automatic string decoder. The repository has no test suite, and its latest commit removed the GitHub CI configuration.",
    "GPL-3.0-only according to package.json and LICENSE.md."
  ],
  "requirements_zh": [
    "审阅时最新版本为 2.4.6，于 2026-07-07 发布到 GitHub 并以 deobfuscator 之名发布到 npm，与所审阅的 master 提交同日；上一版本 2.4.5 发布于 2023-11-09。README 还指向 deobfuscate.relative.im 上的托管网页版。",
    "可用 npm、yarn 或 pnpm 安装，也可直接从 Git 仓库安装；package.json 未声明 Node.js 版本。命令行工具读取单个文件，未指定 --output 时写出 <文件名>.cleaned.<扩展名>，并提供 --rename、--loose 宽松解析、--ecma-version 和 --sourceType 选项。--config 配置文件通过 Node 的 require 加载，因此会作为代码执行；自定义转换器列表会取代默认流程，两个 jsconfuser 转换器只能以这种方式启用，README 也未说明它们。",
    "README 提醒，旧版 javascript-obfuscator 生成的代码很可能无法正确反混淆，自动字符串解码器也没有可供用户调整的配置。仓库没有测试套件，最新一次提交删除了 GitHub CI 配置。",
    "package.json 和 LICENSE.md 声明 GPL-3.0-only。"
  ],
  "targets": [
    "website"
  ],
  "url": "https://github.com/relative/synchrony",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}