Expected Behavior

Obfuscating code that contains a 'use strict' directive should keep 'use strict' as the first statement of the script or function body so that strict mode remains active when selfDefending: true, disableConsoleOutput: true, or debugProtection: true (or the low-obfuscation, medium-obfuscation, or high-obfuscation presets) are enabled.

Evaluating the obfuscated code in the example below should return true.

Current Behavior

Enabling selfDefending: true, disableConsoleOutput: true, or debugProtection: true inserts custom helper declarations and calls before the 'use strict' directive:

function f(){var _0x35c29e=(function(){...}()),_0x145ea1=_0x35c29e(this,function(){...});_0x145ea1();'use strict';return this===undefined;}f();

Because 'use strict' is no longer in the initial directive prologue of f(), strict mode is silently deactivated and evaluating the obfuscated code returns false instead of true.

Steps to Reproduce

1. Obfuscate a function or script containing 'use strict'; with selfDefending: true (or disableConsoleOutput: true / debugProtection: true).
2. Evaluate the obfuscated output and check whether strict mode is active (e.g., this === undefined inside an unqualified function call).

JavaScript Obfuscator Edition

• JavaScript Obfuscator Open Source

Your Environment

• Obfuscator version used: 5.10.0
• Node version used: v24.14.1

Stack trace

N/A (wrong runtime behavior, no exception thrown)

Minimal working example that will help to reproduce issue

const JavaScriptObfuscator = require('javascript-obfuscator');

const code = `function f() {
  'use strict';
  return this === undefined;
}
f();`;

const obfuscated = JavaScriptObfuscator.obfuscate(code, {
  selfDefending: true,
  stringArray: false
}).getObfuscatedCode();

console.log(eval(obfuscated)); // prints false (expected: true)

Credit: https://ucsbplse.github.io/