Quick start

Run without a global install:

npx wakaru input.js -o output.js       # decompile a file
npx wakaru bundle.js --unpack -o out/  # unpack and decompile a bundle
npx wakaru dist/ --unpack -o out/      # scan a bundle output directory

See the CLI reference for rewrite levels, source maps, and more options.

Install

For regular use, install the CLI globally:

npm install -g wakaru@latest

Standalone binaries are available from GitHub Releases.

What it does

Wakaru rewrites the JavaScript AST to recover modern syntax, remove recognized runtime helpers, and split supported bundles into modules.

Minified Babel output:

"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.loadProfile=void 0;
var _api=_interopRequireDefault(require("./api"));
function _interopRequireDefault(e){return e&&e.__esModule?e:{default:e}}
function _asyncToGenerator(e){return function(){var t=this,r=arguments;return new Promise(function(n,o){var a=e.apply(t,r);function i(e){c(a,n,o,i,u,"next",e)}function u(e){c(a,n,o,i,u,"throw",e)}i(void 0)})}}
function c(e,t,r,n,o,a,i){try{var u=e[a](i),c=u.value}catch(e){return void r(e)}u.done?t(c):Promise.resolve(c).then(n,o)}
var loadProfile=function(){var e=_asyncToGenerator(function*(e){var t=yield _api.default.fetchUser(e),r=null!=t.name?t.name:"anonymous";return{name:r,avatar:null==t.profile?void 0:t.profile.avatar}});return function(t){return e.apply(this,arguments)}}();exports.loadProfile=loadProfile;

Wakaru output:

import _api from "./api";
export const loadProfile = async (e)=>{
    const t = await _api.fetchUser(e);
    const name = t.name ?? "anonymous";
    return {
        name,
        avatar: t.profile?.avatar
    };
};

The helpers become async/await, the null checks become ?? and ?., and CommonJS imports and exports become ESM. Some names, such as e and t, stay short because the input does not provide their original names.

What it handles

• Bundles: split webpack, esbuild/Bun, Browserify, and Metro output into readable modules.
• Transpiled code: recover modern syntax from Babel, TypeScript, and SWC output.
• Minified code: expand compact expressions and simplify control flow.

See supported inputs for the full list and format-specific limits.

Guides

• Unminify a webpack bundle: go from a production build to readable modules, starting with the checks that can return the original source.
• Unpack a bundle: choose inputs, include chunks, and pick an unpack mode.
• Read an unpacked bundle: follow a question through the recovered modules.
• Source maps: extract original files or recover names from a map.
• Obfuscated code: what to do when the input is obfuscated, not just minified.

Tested like a compiler

We test both behavior and recovery against real compiler and minifier output:

• 62,171 passing Test262 semantic round trips. Methodology and baseline.
• 94.6% pattern recovery across 2,991 transpiler × minifier test shapes. Per-matrix results.

Use cases

• Security and supply-chain review: inspect the JavaScript a site or dependency ships, with supported bundles split into modules.
• Debugging third-party SDKs: follow the code behind a stack trace or investigate behavior in a distributed build.
• Source recovery: recover readable modules when only build artifacts remain, or extract original files embedded in source maps.

Works with other tools

Wakaru focuses on minifier and transpiler recovery. For supported obfuscation patterns, a deobfuscator such as webcrack can prepare the input before Wakaru processes it. Heavy control-flow or VM-based obfuscation needs a dedicated approach.

For AI-assisted identifier naming, see humanify. Inferred names are reading aids; source maps are the source of original names when available.

Use it from an agent

Give your coding agent readable modules to search and inspect. With the Wakaru skill, it can unpack a bundle and focus on the files relevant to your question, keeping unrelated code out of context.

Install via skills.sh:

npx skills add pionxzh/wakaru

In development: package inventory

Package inventory is under development: identify which npm packages and versions a production bundle contains. It is not part of the current release.

Share your use case to help shape its scope and priority, or contact hello@wakarujs.com.

Contributing

Small fixes, missing recovery patterns, and correctness reports are welcome. For a bug report, include the input, command, current output, and expected behavior. A clear issue is useful even without a proposed fix.

See CONTRIBUTING.md for setup and PR guidance, and docs/README.md for the development documentation.

License

Apache-2.0

_{Usage of Wakaru for attacking targets without prior mutual consent is illegal. End users are responsible for complying with all applicable laws.}