InvisibleJS: Executable ES Modules Hidden in Plain Sight with Zero-Width Characters

A new experimental tool called InvisibleJS has emerged on GitHub, demonstrating how JavaScript source code can be completely hidden from human view while remaining fully executable.

Created by developer oscarmine, this proof-of-concept obfuscation technique leverages zero-width Unicode characters to encode executable payloads that appear as blank files to the naked eye.

How InvisibleJS Works

InvisibleJS employs steganographic techniques to transform JavaScript code into invisible characters.

The tool converts source code into 8-bit binary strings, then maps each bit to a zero-width Unicode character specifically, Zero Width Space (U+200B) for zeros and Zero Width Non-Joiner (U+200C) for ones.

The resulting output appears empty but contains a bootstrap loader that decodes and executes the hidden code at runtime.

The repository offers two distinct versions tailored for different JavaScript environments:

Version 1 (Classic eval) targets CommonJS and traditional scripts, using synchronous eval() execution. This version naturally handles Node.js variables like require, __dirname, and module. exports, making it compatible with older environments and legacy browsers.

Version 2 (Modern import) supports ES Modules and modern applications through dynamic await import() with data URI schemes. This version enables top-level import statements, export keywords, and top-level await functionality, though it requires ES Module support.

Feature	Version 1 (eval)	Version 2 (import)
Invisibility	100%	100%
CommonJS Support	Native	Limited
ESM Support	No	Full Support
Top-Level Await	No	Yes
Execution Method	Synchronous	Asynchronous
Decoder Length	Short	Long

The technique presents significant security concerns. Files encoded with InvisibleJS can bypass visual code inspection, potentially concealing malicious payloads in what appear to be empty files.

The dramatic file-size expansion, approximately 24 times the original, due to UTF-8 encoding, is one potential detection indicator.

Security researchers warn that while InvisibleJS demonstrates clever steganographic encoding, such techniques could be weaponized for code-injection attacks, supply-chain compromises, or to bypass security reviews that rely on manual code inspection.

Both versions utilize identical command-line interfaces for encoding JavaScript files.

The tool is publicly available on GitHub under the oscarmine repository, where it has been published as an educational demonstration of code obfuscation capabilities.

Organizations are advised to implement automated code analysis tools and security scanners that can detect zero-width character encoding schemes to defend against potential misuse of such techniques.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.