javascript-obfuscator 5.9.0 adds Pro API quota checks and machine-readable error codes

What happened on 2026-10-04

At 02:33 UTC on 2026-10-04, javascript-obfuscator published 5.9.0 on GitHub. The release notes have three items. The Pro API gained getProQuota(), which returns the usage left on the API key's plan. ApiError now carries a machine-readable code from the API, and a build refused for quota gets dailyLimit or monthlyLimit. The Node dist bundle is no longer minified, so uncaught errors print readable stack frames. For context, the project README (checked 2026-10-12) says Pro features such as vmObfuscation run through the obfuscator.io cloud service and require a token, while the free package runs offline with no network requests. The README also states that free output is still JavaScript, marks it as exposed to automated LLM-based analysis, and warns that obfuscated code can be 15 to 80 percent slower.

What it means for a defender's threat model

This release does not change protection strength; it is an operational change, yet it highlights two risks that are often overlooked. First, an obfuscation step that depends on a remote service can fail because of quota or network problems. If the build script does not treat that failure as a hard error, unobfuscated code can reach production, which is a more direct problem than weak obfuscation. The new error codes let a pipeline identify quota failures precisely and stop the build. Second, using cloud features means handing the source code you want to protect to a third party, so teams should review contracts, data retention and compliance requirements themselves. As for effectiveness, the project's own README says obfuscation makes reverse engineering harder, not impossible. For high-value core rules, client-side obfuscation only raises cost; the critical logic should still live on the server.

Checks on your own builds

If your pipeline uses Pro features, call getProQuota() before the build starts and log the result. Treat any ApiError, especially dailyLimit and monthlyLimit, as a build failure, and never fall back to shipping unobfuscated output. Add a pre-release self-check, for example comparing output and input hashes and confirming that original sensitive identifiers no longer appear in the output, so you know the obfuscation actually ran. Record the tool version and options used for each release for later audit. Assess whether sending source code to a cloud service fits your data policy. Run full functional and performance regression tests on the obfuscated bundle, since the README explicitly mentions a performance cost. Finally, inventory the front-end bundle for keys or core rules, and move whatever you can to the server.

Your checklist

• Call getProQuota() before builds and abort on any ApiError
• Self-check before release that output is obfuscated and free of original sensitive identifiers
• Assess whether sending source to a cloud service fits your data policy