Using UglifyJs on the whole Node project?

Question

I need to obfuscate my source code as best as possible so I decided to use uglifyjs2.. Now I have the project structure that has nested directories, how can I run it through uglifyjs2 to do the whole project instead of giving it all the input files?

I wouldn't mind if it minified the whole project into a single file or something

Answer 1

I've done something very similar to this in a project I worked on. You have two options:

1. Leave the files in their directory structure.

   This is by far the easier option, but provides a much lower level of obfuscation since someone interested enough in your code basically has a copy of the logical organization of files.

   An attacker can simply pretty-print all the files and rename the obfuscated variable names in each file until they have an understanding of what is going on.

   To do this, use fs.readdir and fs.stat to recursively go through folders, read in every .js file and output the mangled code.

2. Compile everything into a single JS file.

   This is much more difficult for you to implement, but does make life harder on an attacker since they no longer have the benefit of your project's organization.

   Your main problem is reconciling your require calls with files that no longer exist (since everything is now in the same file).

   I did this by using Uglify to perform static analysis of my source code by analyzing the AST for calls to require. I then loaded the source code of the required file and repeated.

   Once all code was loaded, I replaced the require calls with calls to a custom function, wrapped each file's source code in a function that emulates how node's module system works, and then mangled everything and compiled it into a single file.

   My custom require function does most of what node's require does except that rather than searching the disk for a module, it searches the wrapper functions.

Unfortunately, I can't really share any code for #2 since it was part of a proprietary project, but the gist is:

• Parse the source text into an AST using UglifyJS.parse.

• Use the TreeWalker to visit every node of the AST and check if

  node instanceof UglifyJS.AST_Call && node.start.value == 'require'
  

Answer 2

As I have just completed a huge pure Nodejs project in 80+ files I had the same problem as OP. I needed at least a minimal protection for my hard work, but it seems this very basic need had not been covered by the NPMjs OS community. Add salt to injury the JXCore package encryption system was cracked last week in a few hours so back to obfuscation...

So I created the complete solution, that handles file merging, uglifying. You have the option of leaving out specified files/folders as well from merging. These files are then copied to the new output location of the merged file and references to them are rewritten auto.

NPMjs link of node-uglifier

Github repo of of node-uglifier

PS: I would be glad if people would contribute to make it even better. This is a war between thieves and hard working coders like yourself. Lets join our forces, increase the pain of reverse engineering!

Answer 3

I had the same need - for which I created node-optimize and grunt-node-optimize.

https://www.npmjs.com/package/grunt-node-optimize

Answer 4

This isn't supported natively by uglifyjs2.

Consider using webpack to package up your entire app into a single minified .js file, excluding node_modules: http://jlongster.com/Backend-Apps-with-Webpack--Part-I