Getting Started with the JSDefender CLI

JSDefender CLI is a wrapper around the PreEmptive Protection™ JSDefender™ engine. It allows you to run JSDefender as an executable from the command line.

To use the tool, you need to install the @preemptive/jsdefender-cli, and @preemptive/jsdefender-core packages, as described in the Installation section.

You can run the JSDefender CLI without specifying arguments:

jsdefender

In this case, JSDefender checks for an implicit configuration file, jsdefender.config.json in the current working directory, and applies the options specified there. If you have no configuration file in the working directory, JSDefender will error.

For a single file protection scenario, you can use the JSDefender CLI without a configuration file. In this case, JSDefender looks for two mandatory arguments: the input JavaScript source file and the output (protected) file name. For example:

jsdefender myJsBundle.js myProtectedScript.js

JSDefender still looks for the implicit configuration file in the working directory (jsdefender.config.json) and applies it, if found; otherwise, it uses the default protection settings.

JSDefender does not allow specifying input both in the configuration file and command line arguments.

If you specify only one argument, it will be treated as the configuration file.

If you specify more than one argument, they should be the input and output files provided at the same time and/or the CLI flags.

You can also run JSDefender with an explicit configuration file that contains specific protection settings:

jsdefender myJsBundle.js myProtectedScript.js -c myConfig.json
jsdefender myJsBundle.js myProtectedScript.js --config myConfig.json

If you put all protection settings, including the input file name(s), into the configuration file, you can omit the -c or --config options and use the configuration name as the single command line argument:

jsdefender myConfig.json

Instead of using a configuration file, you can apply settings from the command line. For example, either of the following commands run JSDefender with string literal extraction and encoding turned on:

jsdefender myJsBundle.js myProtectedScript.js -e
jsdefender myJsBundle.js myProtectedScript.js --extstr

When using both command line options and the configuration file, the command line options override the settings read from the file. For example, the following command turns on string literal extraction, even if this setting is turned off in the configuration file:

jsdefender myJsBundle.js myProtectedScript.js -c myConfig.json --extstr

The command line provides options that can turn settings off. The next example uses the -E and --extstroff options (they are identical) to turn off string literal extraction (even if the configuration file turns them on):

jsdefender myJsBundle.js myProtectedScript.js -c myConfig.json -E
jsdefender myJsBundle.js myProtectedScript.js -c myConfig.json --extstroff

In this case, JSDefender determines the final set of protection settings as follows:

1. The initial set is read from myConfig.json.
2. The command line arguments (e.g. -E) options override the configuration settings.