0xdevalias/jsdeobf.github.io

JsDeObsBench is a benchmarking tool that tests how well AI language models can clean up deliberately scrambled JavaScript code. In web security, bad actors often obfuscate JavaScript, meaning they intentionally make the code hard to read, to hide malicious behavior like data theft or malware delivery. This project gives researchers a systematic way to measure whether AI models like GPT-4o, Llama, Mixtral, and DeepSeek-Coder can actually reverse that scrambling and produce readable, working code. The benchmark works by running various AI models against JavaScript code that has been obfuscated using different techniques, ranging from simple variable renaming to more complex structural transformations. It then evaluates how well each model performed, looking at factors like whether the cleaned-up code is syntactically correct and whether it runs reliably compared to results from traditional deobfuscation methods. The project also specifically tests how these models handle real-world malicious JavaScript, which is where the security stakes are highest. The primary audience is security researchers and AI developers who need a rigorous, standardized way to evaluate language models on deobfuscation tasks. For example, a security team building automated threat detection tools might use this benchmark to decide which AI model to integrate into their pipeline. Similarly, AI researchers studying code generation capabilities would find this useful for understanding where current models excel and where they fall short. The findings from the project's experiments reveal an interesting tradeoff: the tested AI models were good at simplifying obfuscated code and making it more readable, but they struggled with maintaining syntax accuracy and execution reliability. In other words, the code they produced looked cleaner but didn't always work correctly. This gap between readability and correctness is a key area the project identifies for future improvement, and it highlights both the promise and current limitations of using AI for security-critical deobfuscation work.