@afterpack/vite

A Vite plugin that obfuscates your production JavaScript as part of vite build. It is the AfterPack JavaScript obfuscator for Vite.

Install

npm install --save-dev @afterpack/vite

Usage

// vite.config.ts
import { defineConfig } from "vite";
import { afterpackVite } from "@afterpack/vite";

export default defineConfig({
  plugins: [afterpackVite()],
});

The plugin obfuscates every JavaScript chunk in the bundle before Vite writes it, so the readable bundle never reaches disk. If obfuscation fails, the build fails and your output directory is left untouched.

Files Vite copies as-is from publicDir are not part of the bundle and are not obfuscated. Import anything you want protected.

Each build writes a protection receipt, .afterpack-protection.json, into the output directory. Run npx afterpack verify dist in your deploy step to check that what you ship is what was obfuscated.

Options

afterpackVite({ preset: "hard", seed: "git" });

| Option | What it does | Default | | --- | --- | --- | | preset | "minify", "light", "medium", "hard" or "extreme" | "light" | | seed | a number or string; "git" uses the current commit | a new random seed per build | | identifiers.reserved | names never to rename | none | | paths.exclude | globs for files to leave untouched | none | | sourceMap.enabled | write source maps for the obfuscated output | on in development when Vite emits a map, off in production | | protectionMap.enabled | write the Protection Map | on when Vite emits source maps | | build.autorun | false turns AfterPack off | true |

Dotted names are nested objects: sourceMap.enabled is { sourceMap: { enabled: true } }. Every other option is in the configuration reference.

The Protection Map is written to .afterpack/, which carries its own .gitignore and self-ignores. It contains your original source, so never deploy or commit it.

Options can also live in afterpack.json or in AFTERPACK_* environment variables. The options object wins over the environment, which wins over the file. An unknown or misspelled key fails the build and names the right spelling.

Several Vite builds in one app

Electron and SSR apps can run Vite more than once per build. Give each run a leg name ("main", "renderer", "server") so all of them share one seed and keep separate Protection Maps under .afterpack/<leg>/. Set projectRoot when Vite's root is a subfolder of the app. When the runs are separate processes, pin the seed with AFTERPACK_SEED=git. For Electron, use @afterpack/electron, which sets this up for you.

Pro

Without a key, AfterPack runs on your machine with the full pipeline at any preset. Set AFTERPACK_KEY in your environment and the same plugin builds in AfterPack's cloud instead, which adds per-region directives and two hardening transforms you can turn on: self-integrity (anti-tamper) and comparison hardening. Keep the key out of vite.config.ts: the plugin rejects it there, because the config is committed source. See AfterPack Pro.

Not supported here

• build.backup: the output is handed back to Vite in memory, so there is no file to back up.
• paths.include: the plugin works on Vite's bundle and does not walk the output directory. Use the afterpack CLI if you need that.

Links

• Vite setup guide
• Presets and protection levels
• How AfterPack compares to javascript-obfuscator and Jscrambler
• Protecting paywall and license checks

License

Apache-2.0. The engine it runs, @afterpack/core, has its own license.

Feedback

Questions, suggestions and bug reports: afterpack.dev/contact. You can also file a bug on GitHub Issues.