Analyze JavaScript Code

Client-side JavaScript hides endpoints, secrets, outdated libraries, and insecure patterns that a minified bundle hides from a casual read. This module retrieves JavaScript from a URL list, unpacks it with sourcemaps, beautify, and deobfuscate, then mines endpoints, wordlists, CVEs, and secrets in one pass. It is a retrieve-and-unpack process, not a parser you point at a local dump.

You pass a file of JavaScript URLs. The module retrieves each script and keeps the original location (example.com/, cdn.example.com/), extracts sourcemaps when they are present, then beautifies and deobfuscates what it has. From the unpacked code it mines hidden endpoints and methods, builds custom path and parameter wordlists, checks outdated dependencies for CVEs when it can name them, matches secrets in the unpacked JS, and flags insecure client-side patterns. This is a nestable retrieve-and-unpack process. It is not a parser you point at a local dump.