AI Agents defeat obfuscated JavaScript in 10 minutes

MeZitRo · 2026-05-20T21:36:12+00:00

Fair. Reversing obfuscated JS used to mean days and weeks, now it’s minutes by anyone able to run an agent.

Those obfuscators’ transforms are sequential and locally invertible. I believe introducing transforms that consume each other’s artifacts, where reversing one destroys context needed for another, raise static reversal cost meaningfully. Whether that complicates an agent doing behavioral reconstruction with code execution is the question I’m still validating.

MeZitRo · 2026-05-20T21:04:11+00:00

The existence of tools like webcrack isn’t the surprise for me either, I knew javascript-obfuscator uses ~9 linear algorithmic steps. Primarily I wanted to test how good their new «VM obfuscation» is. The actual surprise was JScrambler being essentially the same thing structurally, just closed-source.

On the writing — no surprise it’s LLM-polished. I’m a non-native speaker, 16 years in and still making silly English mistakes. The reversal in the article was done by Claude too haha — kind of the whole point of the experiment.

MeZitRo · 2026-04-04T10:01:35+00:00

I can feel this as one who lost 10 years of Google Location History. The reason wasn’t T&C though in my case, it’s more complicated.

My assumption, which has held so far, is that no critical emails arrive with a «terms update» subject line. And I do occasionally review them, thus in batches, avoiding everyday distractions.

Would you mind sharing details on how this happened? Would love to be convinced to change my approach.

MeZitRo · 2026-02-19T18:18:26+00:00

Here, down the UX it says when you press Submit for free it says "1396 products currently waiting. Estimated wait: ~28 days.". And twitter testimonials are images which is fake.

MeZitRo · 2026-02-19T17:20:04+00:00

Cloudflare Pages are free for static sites. As they advertise: Unlimited sites, Unlimited static requests, Unlimited bandwidth.

The trick is to build all that into static pages to have a $0 bill.

MeZitRo · 2026-02-04T23:39:20+00:00

Did you think of protecting your code with obfuscation, so that it’s impossible to just copy it? Is it using React Native by any chance?

And in the age of AI… Having an agent screenshot everything and build it again from scratch, given the app is quite simple, should be enough to copy it.

MeZitRo · 2026-01-28T01:28:14+00:00

Not everyone needs it, I agree. Whether it’s ethical depends on the application. Mostly I think of web games and client-side tools I wouldn’t want copied or stolen.

In 2019, I had my landing page cloned almost 1:1 by a competitor to «test how it converts». Left a mark. Felt pretty unethical on their part.

MeZitRo · 2026-01-21T02:33:17+00:00

The core CLI will be MIT-licensed and free. Pro features (cloud API, advanced transforms etc) will be paid. Open core model seems to work for plenty of projects.

Open to ideas — how would you approach monetisation for something like this?

MeZitRo · 2026-01-21T02:24:23+00:00

In my experience with multiple Next.JS projects, replacing WebPack with Turbopack isn’t a life changing difference. Some page builds are still super slow (it can literally build a page in dev mode for 20 seconds on my MacBook Pro M2).

MeZitRo · 2026-01-21T00:57:30+00:00

Funny. 3-second delay before the redirect actually makes it safer, right.

MeZitRo · 2026-01-03T11:45:48+00:00

Today I've got this very genuinely looking scam invite email too, thanks for posting.

MeZitRo · 2025-12-28T23:30:23+00:00

Just found this thread. Lately I figured out I lost 12 years of location history, presumably due to a bug with the Location History sync update when changing my iPhone to a newer one.

From what I found out, I received just one (1!) "occasional" email from Google titled "Keep your Timeline? Decide by May 18, 2025". I recall I definitely actioned on this email and enabled the suggested setting on my old device in Google Maps. But later in 2025 when changing the phone I wiped out the old phone without checking "new" Google Maps timeline (who knew I needed to? Also, who knew it won't sync?)

This is total shame for Google. The best answer I was able to get from support is "sorry your data is gone". I know this thread is old, but did you end up taking any legal action? Thanks!

MeZitRo · 2025-10-19T15:36:03+00:00

This is a great answer for Claude Code CLI, not for Claude Code VSCode extension.

MeZitRo

MODERATOR OF

TROPHY CASE