Skip to content

numbersToExpressions produces invalid syntax for numeric class member keys #1476

Closed

Description

@trackoor

Expected Behavior

Obfuscating a class with non-computed numeric literal method, accessor, or field keys when numbersToExpressions: true is enabled should produce syntactically valid JavaScript (either keeping the numeric literal keys as-is or converting them into computed property names [...]).

Current Behavior

Enabling numbersToExpressions: true rewrites non-computed numeric literal keys on class methods (MethodDefinition), accessors (MethodDefinition), and fields (PropertyDefinition) into arithmetic expressions in place without wrapping them in brackets ([...]), producing invalid JavaScript that fails to parse with SyntaxError: Unexpected token '+'.

NumberToNumericalExpressionTransformer skips non-computed Property keys (NodeGuards.isPropertyNode(parentNode) && !parentNode.computed), but does not check for non-computed MethodDefinition or PropertyDefinition keys.

Steps to Reproduce

  1. Obfuscate a class containing non-computed numeric member keys (e.g., get 2() {}, 3() {}, 4 = 3;) with numbersToExpressions: true.
  2. Parse or execute the obfuscated output (e.g., with new Function(obfuscated)).

JavaScript Obfuscator Edition

  • JavaScript Obfuscator Open Source

Your Environment

  • Obfuscator version used: 5.10.0
  • Node version used: 24.14.1

Stack trace

SyntaxError: Unexpected token '+'
    at new Function (<anonymous>)

Minimal working example that will help to reproduce issue

const JavaScriptObfuscator = require('javascript-obfuscator');

const code = `
class C {
    get 2() { return 1; }
    3() { return 2; }
    4 = 3;
}
`;

const obfuscated = JavaScriptObfuscator.obfuscate(code, {
    numbersToExpressions: true,
    stringArray: false,
    seed: 1
}).getObfuscatedCode();

console.log(obfuscated);
// class C{get 0xce8+-0xe*-0x118+-0x1c36(){return-0x2c0+0x2170+-0x1eaf;}-0x828+-0x3e*-0x4d+-0xa7b*0x1(){return 0x7*0x1a1+-0x1ad8+0x317*0x5;}-0xc1*-0x6+-0xb6*-0x6+-0x8c6=-0xadb*0x2+-0x35e*0x9+-0x3407*-0x1;}

new Function(obfuscated);

Credit: https://ucsbplse.github.io/

Activity

  1. added a commit that references this issue on Nov 11, 2026
  2. sanex3339 commented on Nov 12, 2026

    @sanex3339
    Member

    Released as 5.10.1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions