Static Code Analysis Output as a Proxy Indicator for Classifying JavaScript Obfuscation
TL;DR
It is demonstrated that SCA warnings deviate under obfuscation and provide a practical proxy indicator for distinguishing obfuscated code from human-readable code.
Abstract
: This study investigates whether the output of Static Code Analysis (SCA) tools can serve as a proxy indicator for identifying obfuscated JavaScript. Two datasets are analyzed in their original and obfuscated forms: a controlled pilot dataset focused on common malicious patterns and a larger Kaggle dataset of approximately 1900 real-world JavaScript files. Four SCA tools are applied to both datasets: SonarQube, ESLint, NodeJsScan, and JSHint. The outputs are normalized into a unified feature schema, and pre/post-obfuscation deviance is quantified through issue counts and Kernel Density Estimation (KDE) of warnings normalized by file size and line count. Results show large and consistent increases in issue counts for ESLint and JSHint, substantial rises for SonarQube, and unstable shifts for NodeJsScan. The KDE analysis strengthens the proxy indicator’s effectiveness beyond raw counts by confirming that normalized warning intensity rises after obfuscation for SonarQube and JSHint. These patterns demonstrate that SCA warnings deviate under obfuscation and provide a practical proxy indicator for distinguishing obfuscated code from human-readable code.