When using WXT and Vite to build a browser extension, WXT uses Vite's library mode to bundle content scripts as IIFEs. See https://wxt.dev/guide/essentials/es-modules#content-scripts for details. This leads to false positives.
The WXT project is planned to move to ESM loading in content scripts in the 1.1 release. Until then, we need a workaround.
One solution to this is to change the function_to_array_replacement detector to have a threshold (2% of AST nodes, in line with other detectors.) E.g.,
function detect(flatTree) {
return (flatTree[0].typeMap
.VariableDeclarator || [])
.some(n =>
n.init?.callee?.type
?.indexOf('unction') > -1 &&
n.id?.references?.length &&
functionHasMinimumRequiredRefs(
n.id.references[0],
flatTree) &&
!n.id.references.some(r =>
!(r.parentNode.type ===
'MemberExpression' &&
r.parentKey === 'object'))
) ? obfuscationName : '';
}
When using WXT and Vite to build a browser extension, WXT uses Vite's library mode to bundle content scripts as IIFEs. See https://wxt.dev/guide/essentials/es-modules#content-scripts for details. This leads to false positives.
The WXT project is planned to move to ESM loading in content scripts in the 1.1 release. Until then, we need a workaround.
One solution to this is to change the function_to_array_replacement detector to have a threshold (2% of AST nodes, in line with other detectors.) E.g.,