Search papers, labs, and topics across Lattice.
This paper empirically evaluates the robustness of static application security testing (SAST) tools against obfuscated JavaScript code. The authors define a supply-chain threat model where adversaries inject vulnerable code and obfuscate it to evade detection, then measure the resulting vulnerability detection loss (VDL) using the Njsscan and Bearer SAST tools. Results show that even single obfuscation techniques significantly suppress SAST findings, with stacked techniques leading to near-total evasion and VDL approaching 100%.
"Clean" SAST reports on obfuscated JavaScript code are often a mirage, as even basic obfuscation techniques can blind state-of-the-art tools to critical vulnerabilities.
Code obfuscation is widely adopted in modern software development to protect intellectual property and hinder reverse engineering, but it also provides attackers with a powerful means to conceal malicious logic inside otherwise legitimate JavaScript code. In a software supply chain where a single compromised package can affect thousands of applications, this raises a critical question: how robust are the Static Application Security Testing (SAST) tools that CI/CD pipelines rely on as automated security gatekeepers? This paper answers that question by empirically quantifying the impact of JavaScript obfuscation on state-of-practice SAST. We define a realistic supply-chain threat model in which an adversary injects vulnerable code and iteratively obfuscates it until the pipeline reports a clean scan. To measure the resulting degradation, we introduce the Vulnerability Detection Loss (VDL) metric and conduct a two-phase study. First, we analyze 16 vulnerable-by-design Node.js web applications from the OWASP directory; second, we extend the analysis to 260 in-the-wild JavaScript/Node.js projects from GitHub. Across both datasets, we apply eight semantics-preserving obfuscation techniques and their combinations and evaluate two representative SAST tools, Njsscan and Bearer. Even a single obfuscation technique typically suppresses most baseline findings, including high-severity issues, while stacking techniques yield near-total evasion, with VDL often approaching 100%. Our results show that current JavaScript SAST is fundamentally not robust against commonplace obfuscations and that "clean" reports on obfuscated code may offer only a false sense of security. Finally, we discuss practical mitigation guidelines and directions for obfuscation-aware analysis.
