Obfuscating Code Vulnerabilities Defeats JavaScript SAST Tools in CI/CD Pipelines
arXiv·medium signal
Demonstrates that code obfuscation — already widely used in JavaScript — can conceal malicious logic from static application security testing (SAST) tools that CI/CD pipelines rely on as automated security gates. In the supply chain context where a single compromised npm package affects thousands of applications, this exposes a fundamental gap. Tests multiple commercial and open-source SAST tools against obfuscated vulnerability patterns.