pyjsclear 0.1.2

Pure Python JavaScript deobfuscator

PyJSClear

Pure Python JavaScript deobfuscator.

Installation

pip install pyjsclear

For development:

git clone https://github.com/intezer/PyJSClear.git
cd PyJSClear
pip install -e .
pip install pytest

Usage

Python API

from pyjsclear import deobfuscate, deobfuscate_file

# From a string
cleaned = deobfuscate(obfuscated_code)

# From a file
deobfuscate_file("input.js", "output.js")

# Or get the result as a string
cleaned = deobfuscate_file("input.js")

Command line

# File to stdout
pyjsclear input.js

# File to file
pyjsclear input.js -o output.js

# Stdin to stdout
cat input.js | pyjsclear -

# With custom iteration limit
pyjsclear input.js --max-iterations 20

What it does

PyJSClear applies ~40 transforms in a multi-pass loop until the code stabilises (default limit: 50 iterations). A final one-shot pass renames variables and converts var/let to const.

Capabilities:

• String array decoding (obfuscator.io basic/base64/RC4, XOR, class-based)
• Constant propagation & reassignment elimination
• Dead code / dead branch / unreachable code removal
• Control-flow unflattening (switch-dispatch recovery)
• Proxy function & proxy object inlining
• Expression simplification & modern syntax recovery (?., ??)
• Anti-tamper / anti-debug removal
• Variable renaming (_0x… → readable names)

Large files (>500 KB / >50 K AST nodes) automatically use a lite mode that skips expensive transforms.

Testing

pytest tests/                           # all tests
pytest tests/test_regression.py         # regression suite (62 tests across 25 samples)
pytest tests/ -n auto                   # parallel execution (requires pytest-xdist)

Limitations

• Optimised for obfuscator.io output. Other obfuscation tools may only partially deobfuscate.
• Large files get reduced treatment. Files >500 KB or ASTs >50 K nodes skip expensive transforms; files >2 MB use a minimal lite mode.
• No minification reversal. Minified-but-not-obfuscated code won't be reformatted or beautified.
• Recursive AST traversal may hit Python's default recursion limit (~1 000 frames) on extremely deep nesting.

License

Apache License 2.0 — see LICENSE.

This project is a derivative work based on obfuscator-io-deobfuscator (Apache 2.0) and javascript-deobfuscator (Apache 2.0). See THIRD_PARTY_LICENSES.md and NOTICE for full attribution.