Obfuscating Code Vulnerabilities against Static Analysis in JavaScript Code

Abstract: Code obfuscation is widely adopted in modern software development to protect intellectual property and hinder reverse engineering, but it also provides attackers with a powerful means to conceal malicious logic inside otherwise legitimate JavaScript code. In a software supply chain where a single compromised package can affect thousands of applications, this raises a critical question: how robust are the Static Application Security Testing (SAST) tools that CI/CD pipelines rely on as automated security gatekeepers? This paper answers that question by empirically quantifying the impact of JavaScript obfuscation on state-of-practice SAST. We define a realistic supply-chain threat model in which an adversary injects vulnerable code and iteratively obfuscates it until the pipeline reports a clean scan. To measure the resulting degradation, we introduce the Vulnerability Detection Loss (VDL) metric and conduct a two-phase study. First, we analyze 16 vulnerable-by-design Node.js web applications from the OWASP directory; second, we extend the analysis to 260 in-the-wild JavaScript/Node.js projects from GitHub. Across both datasets, we apply eight semantics-preserving obfuscation techniques and their combinations and evaluate two representative SAST tools, Njsscan and Bearer. Even a single obfuscation technique typically suppresses most baseline findings, including high-severity issues, while stacking techniques yield near-total evasion, with VDL often approaching 100%. Our results show that current JavaScript SAST is fundamentally not robust against commonplace obfuscations and that "clean" reports on obfuscated code may offer only a false sense of security. Finally, we discuss practical mitigation guidelines and directions for obfuscation-aware analysis.

• The paper presents an empirical evaluation demonstrating that semantics-preserving obfuscation can systematically defeat rule- and pattern-based SAST tools in JavaScript applications.
• It employs eight representative obfuscation techniques on controlled and real-world datasets, using the Vulnerability Detection Loss (VDL) metric to quantify the reduction in detection capability.
• Empirical results reveal that even a single obfuscation transformation can lead to an 80-100% drop in detection, exposing fundamental limitations in current static analysis approaches.

Obfuscation-Induced SAST Vulnerability Detection Failure in JavaScript Web Applications

Introduction and Motivation

This paper presents a rigorous empirical evaluation of the adversarial impact of semantics-preserving obfuscation techniques on the efficacy of Static Application Security Testing (SAST) tools in the JavaScript ecosystem (2604.01131). The authors scrutinize the resilience of mainstream SAST tools, which are integral to CI/CD security pipelines, against controlled obfuscation scenarios reflecting modern software supply chain threat models. Through both benchmark-based and large-scale real-world studies, the research dissects the fundamental shortcomings of rule- and pattern-based static analyses when exposed to source code transformations prevalent in both benign and malicious actor workflows.

Threat Model and Adversarial Workflow

The paper formalizes a threat model in which an adversary leverages access (either illicit or via social engineering in public repositories) to inject vulnerable code and perform iterative obfuscation, systematically evading SAST detections prior to code deployment.

Figure 1: Threat Model: Adversarial workflow comprising repository access, malicious payload injection, iterative obfuscation, SAST evasion loop, and deployment.

This model captures the contemporary risk in supply chain environments, emphasizing the feasibility of turning CI/CD processes into attack vectors when static security gates lack obfuscation awareness. The attacker validates the evasion with the same SAST tools as used by defenders, achieving a "clean" scan despite the presence of exploitable vulnerabilities.

Obfuscation Techniques and SAST Vulnerability Taxonomy

The study selects eight representative obfuscation transformations from Collberg's taxonomy—data, layout, control, and preventive techniques—using the javascript-obfuscator library. These include layout compaction (CMP), control flow flattening (CFF), dead code injection (DCI), anti-debugging/preventive routines (DP, SD), string literal encoding (SA, SS), and syntactic simplification (SIMP).

The candidate vulnerabilities encompass the OWASP Top 10 categories, including high-impact flaws such as XSS, injections, and remote code execution. The SAST tools Njsscan and Bearer are analyzed under stringent criteria: maturity, vulnerability coverage, free accessibility, and robust support for contemporary JavaScript (ES6+).

Experimental Methodology

The evaluation is grounded in two datasets: a controlled Ground-Truth corpus of 16 deliberately vulnerable Node.js web applications with verified flaws (sourced from the OWASP directory) and a large-scale In-the-Wild corpus of 260 real-world JavaScript/Node.js projects from GitHub. Each project is subjected to all possible single and stacked obfuscation configurations.

Detection degradation is quantified via the Vulnerability Detection Loss (VDL) metric, defined as the percentage of baseline findings eliminated post-obfuscation.

Empirical Results

Baseline Detection Collapse

The benchmark analysis shows both SAST tools are systematically fragile. Njsscan exhibits zero baseline detection in several projects, with median VDL reaching 100% on the remainder—even minimal obfuscation suffices for total evasion. Bearer demonstrates slightly more variance, retaining signal only in select projects, but is equally susceptible to obfuscation-induced loss in high-severity cases.

(Figure 2)

Figure 2: VDL distributions for Njsscan and Bearer on Ground-Truth dataset highlighting total vulnerability suppression via obfuscation.

Single-Plugin Evasion Efficacy

For the real-world dataset, every individual obfuscation technique routinely achieves high (often 100%) median VDL for both tools. Severe vulnerabilities (Njsscan "Error"; Bearer "High/Critical") are particularly susceptible, confirming the breakdown of AST- and pattern-based analysis under even rudimentary source transformation.

(Figure 3)

Figure 3: VDL distributions for individual obfuscation techniques, stratified by internal tool severity, evidencing complete evasion for critical vulnerabilities.

Stacked Obfuscation and Plateau Effects

Stacking multiple obfuscation plugins marginally increases VDL, but both tools exhibit pronounced diminishing returns; the evasion plateau occurs at five active techniques. For Njsscan, mean VDL rises from ∼80% (single plugin) to ∼94% (five plus), with interquartile compression evidencing uniform tool collapse. Bearer hits ∼85% VDL with one plugin, plateauing at ∼89% with further stacking.

(Figure 4)

Figure 4: Cumulative mean VDL as a function of active plugin count showing rapid plateau and diminishing returns.

Practical and Theoretical Implications

These findings directly undermine confidence in "clean" SAST scans on obfuscated code in CI/CD settings. The core failure mechanism is traceable to the syntactic scope of static vulnerability detection—obfuscations dissociate vulnerable source–sink relations from expected patterns and tree structures, breaking shallow AST, regex, and rule-based logic.

Immediate pipeline mitigations include obfuscation flagging, normalization/preprocessing (deobfuscation, minification restoration), and orthogonal integration of DAST and fuzz testing for critical attack surfaces. From a research perspective, robust SAST demands semantic-lifting and normalization passes, adversarially-trained vulnerability detectors, and advances in symbolic/concolic analysis capable of recovering flows obscured by opaque predicates and flattened control constructs.

Limitations and Future Directions

The study scope is limited to open-source tools and obfuscators; proprietary or commercial platforms might differ in robustness but lack generalizable deployment. Dynamic testing, while more resilient to semantics-preserving transformations, is coverage-limited and equally vulnerable to anti-instrumentation. VDL is contingent on each tool's baseline detection capability, and dataset representativeness is constrained by language and architectural diversity. Further research into permutation effects and operational test failures is warranted.

Continued advancement in obfuscation-resilient SAST may leverage learning-based detectors and normalization-pass hybrid approaches, especially as GenAI-assisted code security matures.

Conclusion

The investigation conclusively demonstrates that contemporary JavaScript SAST tools integrated in DevSecOps pipelines are not robust to semantics-preserving obfuscation. Even a single transformation reliably defeats pattern- and rule-based detections, including for high-severity vulnerabilities. "Clean" static analysis reports on obfuscated code are thus an unreliable indicator of security assurance. Effective mitigation mandates obfuscation awareness, normalization, and complementary dynamic testing. The study establishes empirical foundations for obfuscation-adaptive SAST research in web security.

See (2604.01131) for full reference list including foundational works on static analysis, web security, code obfuscation, and attack methodology.