Code Transposition Eval

What changes

After the code has been transposed into a generated wrapper, this option stores that wrapper in an encoded string and reconstructs it at runtime with eval. The output no longer contains your logic as inspectable code — a reader opening the file sees a decoder and a blob, and getting from there to your statements means executing or emulating the decoder.

Because a function body may contain return or reference arguments, the packed body is wrapped and applied against the current this and arguments when needed, so semantics are preserved across the eval boundary.

Configuration

{
  "options": {
    "ReorderCode": true,
    "ReorderCodeEval": true,
    "ReorderCodeEvalMinSize": 512
  }
}

Set ReorderCodeEvalMinSize to something non-trivial. Without a floor, small helpers get a decoder each and you pay overhead everywhere for protection that only matters on substantial bodies.

Where this option will not run

String-to-code execution is blocked or discouraged in more places every year. Confirm your target allows it before you build a release around this option:

• Strict Content Security Policy. A policy without unsafe-eval blocks the reconstruction outright. You get a CSP violation in the console and a dead feature, not a traceable error. Note that only this option and SelfCompression have this requirement — the rest of the engine's transforms run fine under a strict policy.
• Browser extensions. Chrome's MV3 service worker forbids eval and remotely-hosted code. This option is not usable in an extension — see protecting browser extension JavaScript, which also covers the store policy on obfuscation generally.
• Locked-down runtimes. Some embedded engines, kiosk environments, and app-store review processes reject eval use on principle.
• Security review. Even where it works, expect to justify it. eval in a shipped bundle is the pattern malware uses, and it draws attention from scanners and reviewers — a cousin of the problem described in why obfuscated JavaScript trips antivirus.

Strength and trade-offs

• Stronger against static inspection than Code Transposition alone, because the logic is not present as code in the shipped file.
• Increases file size because of the additional wrapper and decoder.
• Adds runtime cost: the body must be reconstructed before it executes. With ReorderCodeEvalAll that cost is spread across the whole file.
• Does not stop dynamic analysis. An analyst who can run the code can capture what the decoder produces — this raises cost, it does not remove the possibility. See AI resistance evidence for how we frame that limit.
• Makes stack traces point into reconstructed code, so keep the identifier map and use symbolication.

Consider VM protection instead

If your goal is to remove specific sensitive functions from inspectable JavaScript form, VM protection targets that directly — selected functions become bytecode for a generated interpreter — and it is scoped to the functions you nominate rather than the whole file. For a licence check or a pricing rule, that is usually the better trade than packing everything through eval.