Source Map

Option name: "sourceMap"
Option values: true/false/Object

What Source Maps Are For

Source maps let you map obfuscated output back to your original source code. This is useful during development so stack traces and debuggers reference meaningful line numbers and variable names instead of the obfuscated output. Obfuscation can break stack traces. Transformations like control flow flattening, variable renaming, and string concealing shift code locations significantly. Without a source map, a thrown error may point to a line in the obfuscated file that has no clear relationship to the original code.

Security Warning

A source map contains your entire original source code. Never ship source maps to production or expose them publicly; this would completely defeat the purpose of obfuscation. Keep source map files server-side, away from any reverse engineers.

External Source Maps

The source map is written to a separate .map file. The obfuscated file references it via a comment at the bottom. This is the recommended approach for source maps.

External Source Map

//# sourceMappingURL=dev.output.js.map

Inline Source Maps

The source map is base64-encoded and embedded directly in the output file. Convenient for quick testing, but the source is exposed to anyone with the file.

Inline Source Map

//# sourceMappingURL=data:application/json;base64,...

For most projects, external maps with restricted access to the .map file is the recommended approach.

Source Map Options

You may provide true or an Object of type SourceMapOptions for the option sourceMap in your obfuscator settings. The field fileName will be set to "script.js" if not provided.

Property	Type	Description
`fileName`	`string`	The file name found in the ‘sources’ array

Usage Example

The provided code example will obfuscate the file dev.input.js and write the output to a file named dev.output.js with a source map file named dev.output.js.map.

Example Usage

import { readFile, writeFile } from "fs/promises";
import JsConfuser from "js-confuser";

const sourceCode = await readFile("./dev.input.js", "utf-8");

var result = await JsConfuser.obfuscate(sourceCode, {
  target: "node",
  preset: "medium",
  sourceMap: {
    fileName: "dev.input.js"
  },
});

// External source map, to be added to the bottom of the file
result.code += `\n//# sourceMappingURL=dev.output.js.map`;

// Save files
await writeFile("dev.output.js", result.code, { encoding: "utf-8" });
await writeFile("dev.output.js.map", JSON.stringify(result.map), {
  encoding: "utf-8",
});

Testing Source Maps in Chrome DevTools

Open Chrome DevTools (F12) and go to the Sources tab.
Load your obfuscated file in the browser.
If the source map is detected, DevTools will show your original source file in the file tree under the Sources panel.
Set breakpoints, step through code, and inspect variables as if the obfuscation never happened.
If the original source is not appearing, check that the sourceMappingURL comment at the bottom of your output file points to the correct .map file path, and that the .map file is being served.

For Node.js, use --enable-source-maps when running your script:

Node.js Source Maps

node --enable-source-maps dev.output.js

This makes Node resolve source map locations in stack traces automatically.

Getting Started

Options

Presets

What Source Maps Are For

Security Warning

External Source Maps

Inline Source Maps

Source Map Options

Usage Example

Testing Source Maps in Chrome DevTools

See Also

​What Source Maps Are For

​Security Warning

​External Source Maps

​Inline Source Maps

​Source Map Options

​Usage Example

​Testing Source Maps in Chrome DevTools

​See Also

What Source Maps Are For

Security Warning

External Source Maps

Inline Source Maps

Source Map Options

Usage Example

Testing Source Maps in Chrome DevTools

See Also