Expected Behavior

Obfuscating code containing an ES2022 private field brand check (#x in obj) with controlFlowFlattening: true should produce valid JavaScript that evaluates #x in obj.

Current Behavior

controlFlowFlattening rewrites #x in o into a control-flow storage helper call _0x59329f['qJSun'](#x, _0x61f7aa). Because a PrivateIdentifier (#x) is only syntactically valid on the left-hand side of in and cannot be passed as a function argument, the obfuscated output fails to parse with SyntaxError: Unexpected identifier '#x':

class C{#x;static['has'](_0x61f7aa){var _0x59329f={'qJSun':function(_0x4969d4,_0x18f302){return _0x4969d4 in _0x18f302;}};return _0x59329f['qJSun'](#x,_0x61f7aa);}}

Steps to Reproduce

1. Obfuscate a class containing #x in o with controlFlowFlattening: true and controlFlowFlatteningThreshold: 1.
2. Parse or execute the obfuscated code.

JavaScript Obfuscator Edition

• JavaScript Obfuscator Open Source

Your Environment

• Obfuscator version used: 5.10.0
• Node version used: 24.14.1

Stack trace

SyntaxError: Unexpected identifier '#x'
    at new Function (<anonymous>)

Minimal working example that will help to reproduce issue

const JavaScriptObfuscator = require('javascript-obfuscator');

const code = 'class C { #x; static has(o) { return #x in o; } }';
const out = JavaScriptObfuscator.obfuscate(code, {
  controlFlowFlattening: true,
  controlFlowFlatteningThreshold: 1,
  stringArray: false,
  seed: 1
}).getObfuscatedCode();

console.log(out);
new Function(out);

Credit: https://ucsbplse.github.io/