Formatting a JavaScript file can change its program

A new vulnerability called divergence shows that formatting or minifying JavaScript can change a program’s logic. The author catalogued 186 techniques across 37 tools, including popular formatters and deobfuscators such as Prettier, esbuild and WebCrack. By exploiting bugs in these processors, a script that originally played Tetris can become a Snake game after a simple formatting pass. Divergence is a decoy: the modified script still runs, but its behavior is different and the change is invisible to casual checks.

How the Formatter Works

Chrome DevTools uses a whitespace‑only formatter that copies tokens from the source, but it mistakenly glues two plus signs into a single increment operator. In the example, the line '+ +m;' turns into '++m;', turning a no‑op into an increment that changes program state. WebCrack, a Babel‑based deobfuscator, rewrites patterns like 'a || (a = 1)' into 'a ||= 1', reducing side effects but altering logic. These bugs occur because the tools match syntax patterns without evaluating runtime effects.

The impact is significant for LLMs and human reverse engineers, who usually format obfuscated code to understand it. Divergence means that the reformatted code may run a different program, so the reverser ends up analyzing the wrong logic. It also thwarts reimplementation attacks, because a server can detect values sent by the diverged client that never appear in the original script. The author demonstrated the technique with a playground that turns a Tetris script into a Snake script when passed through any of the listed processors.