0

I'm building a chrome extension with Parcel. According to chrome webstore policy (that hosts Chrome extensions) - Chrome extensions are prohibited to use obfuscation.
Unfortunately, for now, we cannot move mission-critical code to a server; and have to keep it inside the extension code, which is very easy to download and read.
Although, Parcel minifies the code - it's still possible to reverse engineer, especially because Parcel doesn't mangle import paths. For now my bundled files look similar to this (excerpt):

        is_js: "YVwU",
        "../../../../../../../utility-belt/helpers/dom/is-el-visible": "NBkX",
        "./preformat-label-text": "uVmy",
        "./find-label-element/find-label-element": "PpOy",
        "../../../../../../../utility-belt/helpers/array/has-contents": "gtdY",
        "../../../../../../../utility-belt/helpers/dom/get-text-content-from-el": "SRGb",
        "./input-is-empty": "xrMH",
        "../../edge-cases/raw-inputs-found": "b9fD",
        "../../edge-cases/associated-labels": "KiPW",
        "../../../../../../../utility-belt/helpers/dom/compare-DOM-positions": "lAHL",
        "../../../../../../data/dictionary/BANKS": "CVde",
        "../../../../../../../utility-belt/helpers/dom/DOM-shortcuts": "lN5N",

As you can see - from file names and paths, with some effort it can be deduced what each module does, and also its hash name. From hash name its contents are found and read.
It would really help if those imports be obfuscated or encoded. Is there a way to achieve that?

avalanche1
  • 3,154
  • 1
  • 31
  • 38

1 Answers1

1

If you really need to do this and have some time, you can use the help of (ironically) reverse-engineering tool - https://github.com/Xmader/retidy

What you could do is:

Use it to get a list of all modules in your app, then using this map of module paths, you can simply iterate over your bundle and search-replace each path with some random string. The bundle should still work just fine.

This will only hide your paths, but it could still make life a bit harder for someone trying to reverse-engineer your code.

Adam Pietrasiak
  • 12,773
  • 9
  • 78
  • 91