javascript-obfuscator 5.4.5 and 5.4.6: correctness fixes in obfuscating transforms

What happened on this date

On 2026-07-09, javascript-obfuscator published 5.4.5 (11:20 UTC) and then 5.4.6 (19:59 UTC) on GitHub. 5.4.5 fixed three issues: controlFlowFlattening could drop arguments in spread calls such as foo(...args) when it reused a control-flow wrapper (#1423); selfDefending made obfuscated code run several times slower on Bun/JavaScriptCore (#1421); and parentheses around an in operator inside an arrow-function body in a for-loop initializer were dropped, producing unparsable output (#1419). 5.4.6 fixed the obfuscator decoding string literals written with Unicode or hexadecimal escapes into their actual characters (linked to #345). All four fixes concern output that was either wrong, slower or no longer valid JavaScript, rather than new protection features.

What it means for protecting app logic

These fixes show the real cost of obfuscation: transforms change code, and change can introduce bugs. Syntax errors at least surface immediately; the dangerous ones are silent, like a spread call losing arguments, where the code runs but its behavior quietly differs. Performance issues are runtime-specific: an option may be fine on V8 yet clearly slower on JavaScriptCore, so Electron, browsers, React Native or Bun each need their own validation. For JavaScript apps, obfuscation only raises reading cost; the code still ships with the package, and options such as selfDefending are not a security boundary. When deciding whether to use it and which options to enable, factor in the maintenance and regression cost.

Checks to run on your own builds

First, pin the obfuscator version in your lockfile and read release notes before upgrading to see whether the options you enable are affected; if you use controlFlowFlattening or selfDefending, assess moving to a version with these fixes. Second, test the obfuscated output, not the source: run end-to-end tests in CI against the final bundle, covering spread arguments, loops and string handling. Third, benchmark on every target runtime, comparing launch time and key operations before and after obfuscation. Fourth, keep source maps for internal error tracking only and never ship them. Fifth, keep keys, authorization decisions and core algorithms server-side, using obfuscation only as a supplement.

Your checklist

• Pin the obfuscator version and check affected options before upgrading
• Run end-to-end tests on the final obfuscated bundle
• Compare performance on every target runtime
• Never ship source maps; keep core logic server-side