Obfuscating Code Vulnerabilities against Static Analysis in JavaScript Code

TL;DR

This paper empirically demonstrates that common JavaScript obfuscation techniques can significantly undermine the effectiveness of static analysis tools in detecting vulnerabilities, revealing a critical security gap.

Contribution

It introduces the Vulnerability Detection Loss metric and systematically evaluates the impact of obfuscation on SAST tools across multiple datasets.

Findings

Obfuscation techniques often suppress high-severity vulnerability findings.

Stacked obfuscations can nearly completely evade static analysis detection.

Current JavaScript SAST tools are not robust against common obfuscation methods.

Abstract

Code obfuscation is widely adopted in modern software development to protect intellectual property and hinder reverse engineering, but it also provides attackers with a powerful means to conceal malicious logic inside otherwise legitimate JavaScript code. In a software supply chain where a single compromised package can affect thousands of applications, this raises a critical question: how robust are the Static Application Security Testing (SAST) tools that CI/CD pipelines rely on as automated security gatekeepers? This paper answers that question by empirically quantifying the impact of JavaScript obfuscation on state-of-practice SAST. We define a realistic supply-chain threat model in which an adversary injects vulnerable code and iteratively obfuscates it until the pipeline reports a clean scan. To measure the resulting degradation, we introduce the Vulnerability Detection Loss (VDL) metric and conduct a two-phase study. First, we analyze 16 vulnerable-by-design Node.js web applications from the OWASP directory; second, we extend the analysis to 260 in-the-wild JavaScript/Node.js projects from GitHub. Across both datasets, we apply eight semantics-preserving obfuscation techniques and their combinations and evaluate two representative SAST tools, Njsscan and Bearer. Even a single obfuscation technique typically suppresses most baseline findings, including high-severity issues, while stacking techniques yield near-total evasion, with VDL often approaching 100%. Our results show that current JavaScript SAST is fundamentally not robust against commonplace obfuscations and that "clean" reports on obfuscated code may offer only a false sense of security. Finally, we discuss practical mitigation guidelines and directions for obfuscation-aware analysis.