javascript · 7

JavaScript & Electron

Electron and other packaged JavaScript apps: unpacking app.asar, mapping modules with source maps, and following preload scripts and IPC channels into native add-ons. Other guides unpack an ASAR file in the browser, recover readable modules from a minified bundle, decode a production stack trace with a source map, and audit your own npm package for source map leaks before you publish it.

• Electron Fuses Explained: How to Read RunAsNode, OnlyLoadAppFromAsar and the Rest

  What each of the nine Electron fuses controls (RunAsNode, OnlyLoadAppFromAsar, ASAR integrity and more), which value is hardened, and how to read them from a packaged app without launching it.

  7 min read · REA 6.7.0

• How to Decode a Minified JavaScript Stack Trace with a Source Map

  Decode a minified stack trace like app.js:1:68 back to the original file, line and name: keep hidden source maps, look up each frame locally, and fix map mismatches.

  6 min read

• How to Deobfuscate javascript-obfuscator (obfuscator.io) Code: 14 Option Sets Tested

  What an obfuscator.io deobfuscator can undo: string arrays, base64 and RC4, wrappers and control-flow flattening came back; renameProperties and local names did not. Tested at 14 option sets.

  7 min read

• How to Reverse Engineer a Webpack Bundle and Recover the Source

  Recover readable source from a minified webpack bundle: extract sourcesContent from a .map, split the module table with Wakaru, and map chunks and requests with REA. Real output.

  6 min read · REA 6.7.0

• How to Reverse Engineer an Electron App: ASAR, Preload and IPC

  Reverse engineer a real Electron app (Joplin 3.7.22): copy and extract app.asar, read webPreferences and preloads, map IPC channels, find native add-ons and check the fuses. Real output.

  7 min read · REA 6.7.0

• How to Unpack an ASAR File: Extract app.asar on Windows, macOS and Linux

  Find app.asar on Windows, macOS or Linux, unpack it in your browser or with npx @electron/asar, and read package.json, main, preload and IPC channels first.

  6 min read

• Source Map Leaks in npm Packages: How to Check and Disable Source Maps in Production

  Find a source map leak before you publish: list .map files with npm pack --dry-run, see what sourcesContent exposes, disable or hide source maps in production, and gate it in CI.

  7 min read