JavaScript deobfuscation, built as a compiler.

devirt turns obfuscated JavaScript back into readable, behavior-equivalent source — no per-sample rules, just general, semantics-preserving transforms run to a fixpoint and verified against the original's observable behavior.

• devirt-core — the open-source deobfuscation engine and deob CLI, written in Rust. Dual licensed MIT / Apache-2.0.
• devirt.dev — the hosted product.
• devirt-corpus — an obfuscated-JavaScript benchmark dataset with live readability scores.

The engine parses with oxc, runs a fixpoint of AST rewrites — normalization, dataflow (constant folding, inlining, dead-code elimination), control-flow recovery over an SSA IR, and sandboxed string-decoder evaluation — and prints readable JavaScript whose behavior is verified to match the input.