Bytenode

A minimalist bytecode compiler for Node.js.

This tool truly compiles your JavaScript code into V8 bytecode, so that you can protect your source code. It runs on Node.js and Electron. See examples/ for current runnable projects.

Install

npm install --save bytenode

Or globally:

sudo npm install -g bytenode

Security and Code Protection Note

Bytenode compiles JavaScript into V8 bytecode, which removes original source formatting, comments, and variable names, drastically increasing the barrier to entry for reverse engineering. However, be aware that V8 bytecode is not encryption. Decompilation and analysis tools exist, such as View8 and Ghidra plugins. These tools are valuable for the cybersecurity community to audit applications and analyze malicious code. Some of them extract only abstract pseudo-code from .jsc files, while others can decompiles them back to readable JavaScript.

If your goal is maximum intellectual property protection, Bytenode should not be your only line of defense. We recommend adding an obfuscation step (using tools like javascript-obfuscator) into your build pipeline before compiling the code with Bytenode. This ensures that even if the bytecode is decompiled, the resulting JavaScript remains unreadable and hard to reverse-engineer.

Known Issues and Limitations

• In Node 10.x, Bytenode does not work in debug mode. See #29.

• Any code depends on Function.prototype.toString function will break, because Bytenode removes the source code from .jsc files and puts a dummy code instead. See #34. For a workaround, see #163

• Async Arrow Functions (and Arrow Functions in general) cause crashes in Puppeteer and in Electron apps. See #106, #47. They also cause issues with the ndb debugger. See #135. It seems that whenever there is a context change (or even when called from another file or module), arrow functions break because V8 inspects them internally using Function.prototype.toString in these cases. See #157.

• Electron ≥ 42 (V8 ≥ 14.8): bytecode compiled via ELECTRON_RUN_AS_NODE crashes the main process with SIGTRAP. V8's serialized bytecode header carries a _read-only snapshot checksum_ (header offset 16). The Electron main/browser process boots V8 from Chromium's v8_context_snapshot, whose read-only heap differs from the Node default snapshot used by ELECTRON_RUN_AS_NODE. So a .jsc produced with compileElectronCode() (run-as-node) carries a checksum that does not match the main process. Starting with V8 14.8 this no longer fails gracefully (cachedDataRejected) but hard-aborts (EXC_BREAKPOINT / SIGTRAP) while deserializing. The fix is to compile in the same process type that will load the .jsc — use compileElectronMainCode() or compileFile({ electronMain: true }), which compile inside an actual Electron main process. (On Electron ≤ 41 / V8 ≤ 14.6 the two checksums happened to be compatible, so electron: true worked there.)

• Electron renderer bytecode is context-specific. On Electron 43.5.1 and later, the renderer snapshot differs from the Node and main-process snapshots. The project’s reported checks found that bytecode compiled with electron: true or electronMain: true was rejected by renderer preloads/pages, while renderer-compiled bytecode loaded in both. Use compileElectronRendererCode() or compileFile({ electronRenderer: true }) for renderer code. This mode compiles in a hidden window’s preload, so the result is suitable for renderer/preload contexts and should not be used in the main process or worker threads. The reported compatibility checks covered Electron 43.4.1, 43.5.1, 43.7.3, and 44.4.3; verify the mode against the exact Electron versions you ship. See #265.

Resources

• How To Compile Node.js Code Using Bytenode
• Bytenode Webpack Plugin
• Creating JS Binaries For Electron
• Electron Bytenode Example

Examples

• Node.js CommonJS module: compile a module,

• Electron main process: compile the main

Bytenode CLI

Usage: bytenode [option] [ FILE... | - ] [arguments]
Options:
    -h, --help                        show help information.
    -v, --version                     show bytenode version.
-c, --compile [ FILE... | - ]     compile stdin, a file, or a list of files
    --compress                        compress bytecode
    --source-map                      write an external source map beside each .jsc file
    -n, --no-module                   compile without producing commonjs module
    -e, --electron                    compile for Electron
    -ep, --electron-path              path to Electron executable
-l, --loader [ FILE | PATTERN ]   create a loader file and optionally define
                                      loader filename or pattern using % as
                                      filename replacer
                                      defaults to %.loader.js
    --no-loader                       do not create a loader file, conflicts
                                      with -l
    -t, --loader-type type            create a loader file of type commonjs or
                                      module. Defaults to CommonJS
Examples:
$ bytenode -c script.js             compile script.js to script.jsc.
  $ bytenode -c server.js app.js
  $ bytenode -c src/*.js              compile all .js files in src/ directory.
$ bytenode -c *.js -l %.load.js     create filename.load.js loader files along side .jsc files
$ bytenode script.jsc [arguments]   run script.jsc with arguments.
  $ bytenode                          open Node REPL with bytenode pre-loaded.

Examples:

• Compile express-server.js to express-server.jsc.

user@machine:~$ bytenode --compile express-server.js

• Run your compiled file express-server.jsc.

user@machine:~$ bytenode express-server.jsc
Server listening on port 3000

• Compile all .js files in ./app directory.

user@machine:~$ bytenode --compile ./app/*.js

• Compile all .js files in your project.

user@machine:~$ bytenode --compile ./*/.js

Note: you may need to enable globstar option in bash (you should add it to ~/.bashrc): shopt -s globstar

• Starting from v1.0.0, bytenode can compile from stdin.

echo 'console.log("Hello");' | bytenode --compile - > hello.jsc

Bytenode API

const bytenode = require("bytenode");

bytenode.compileCode(javascriptCode) → {Buffer}

Generates v8 bytecode buffer.

• Parameters:

• Returns:

• Example:

let helloWorldBytecode = bytenode.compileCode(
  console.log('Hello World!');
  43;  // this will be returned,
);

This helloWorldBytecode bytecode can be saved to a file. However, if you want to use your code as a module (i.e. if your file has some exports), you have to compile it using bytenode.compileFile({compileAsModule: true}), or wrap your code manually, using Module.wrap() function.

bytenode.compileElectronCode(javascriptCode, options) → {Promise\}

Asynchronous function which generates v8 bytecode buffer for Electron.

Same as bytenode.compileCode(), but generates bytecode for the version of Electron currently installed in node_modules.

• Parameters:

• Returns:

let helloWorldBytecode = await bytenode.compileElectronCode(
  console.log('Hello World!');
  43;  // this will be returned,
);

let helloWorldBytecode = await bytenode.compileElectronMainCode(
  console.log('Hello World!');
  43;  // this will be returned,
);

const result = bytenode.runBytecode(helloWorldBytecode);
// prints: Hello World!
console.log(result);
// prints: 43

let compiledFilename = bytenode.compileFile({
  filename: "/path/to/your/file.js",
  sourceMap: true,
  output: "/path/to/compiled/file.jsc", // if omitted, it defaults to '/path/to/your/file.jsc'
});

let compiledFilename = await bytenode.compileFile({
  filename: "/path/to/your/file.js",
  output: "/path/to/compiled/file.jsc",
  compileAsModule: false,
});

let compiledFilename = await bytenode.compileFile({
  filename: "/path/to/your/main.js",
  output: "/path/to/compiled/main.jsc",
  electronMain: true, // Electron main-process compile (Electron >= 42 / V8 >= 14.8)
  // electron: true  // legacy ELECTRON_RUN_AS_NODE compile (Electron <= 41)
});
// Preload scripts and renderer pages when renderer-specific bytecode is needed:
await bytenode.compileFile({
  filename: "/path/to/your/preload.js",
  output: "/path/to/compiled/preload.jsc",
  electronRenderer: true,
});

// test.js
console.log("Hello World!");
43; // this will be returned

const result = bytenode.runBytecodeFile("/path/to/test.jsc");
// prints: Hello World!
console.log(result);
// prints: 43

let myModule = require("/path/to/your/file.jsc");

BYTENODE_DEBUG=1 ./your-electron-app

[bytenode] runtime: node v24.16.0, electron 42.4.1, v8 14.8.178.31-electron.0
[bytenode] on-disk .jsc header (before fixBytecode) ...
  versionHash  @4  = 0x995ac8a1   <- must match runtime
  flagHash     @12 = 0x24360e99   <- must match runtime (V8 flags)
  roChecksum   @16 = 0x2c3e475a   <- must match runtime (read-only snapshot)
[bytenode] runtime dummy header (what V8 expects) ...
[bytenode] vm.Script created, cachedData accepted.