jsmap-pro

Quick Start

The command is jsmap. The repository is named jsmap-pro.

Install once from source — Linux / macOS

Requires Go 1.24+ and Git. If you already cloned the repository, start from its directory and skip the first two lines:

git clone https://github.com/Hzkun001/jsmap-pro.git
cd jsmap-pro
./install.sh

Run

jsmap example.com

Replace example.com with your website containing JavaScript assets. HTTPS is used automatically. For HTTP, supply http:// explicitly. Reports go to jsmap-output/.

jsmap example.com -o results
jsmap -har capture.har -o results-har
jsmap -d ./assets -o results-local
jsmap -h

Options work before or after the target. Output directories must be new or empty.

[!TIP] ./install.sh installs to /usr/local/bin, which must already be in PATH. It requests sudo only when needed. After installation, jsmap works immediately in any directory and in new terminals; no shell configuration changes are required.

Without Go — release binary

Download and extract the archive for your OS/CPU from Releases. Releases starting at v0.1.4 contain jsmap (Windows: jsmap.exe). Starting at v0.1.5, archives also include install.sh; it installs the bundled binary without Go. Older archives can be installed with sudo install -m 755 jsmap /usr/local/bin/jsmap.

From the extracted directory on Linux/macOS:

./install.sh
jsmap example.com

On Windows, run .\jsmap.exe example.com in PowerShell from the extracted directory, or add its directory to PATH to use jsmap.

Run directly from a checkout

go run . example.com

To build a binary in the current directory:

go build -o jsmap .
./jsmap example.com

Input modes

Choose one input source per scan:

jsmap -l urls.txt -c 20 -o results-urls
jsmap -har capture.har -o results-har
jsmap -d ./assets -o results-local

urls.txt contains one HTTP(S) URL per line. Blank lines and lines starting with # are ignored. The output directory must be new or empty so earlier results are preserved.

What it scans

Each finding includes a file, line number, category, and code snippet. Raw JavaScript is scanned while streaming to disk. When a supported string-array getter is found, the AST inliner also scans its normalized output in analyzed/.

Source maps

When JavaScript ends with //# sourceMappingURL=..., jsmap checks the map and reconstructs its sourcesContent under unpacked/. The status Fully Reconstructed via SourceMap is used only when every source was written successfully. Missing source content and unsafe paths are reported.

HAR and directory modes are offline: source maps are read only when present in the HAR or input directory.

CLI options

Build and contribute

Requires Go 1.24 or later. This minimum is needed for os.Root, which keeps source-map extraction within the output directory.

go build -ldflags="-s -w" -o jsmap .
go test -race ./...
go vet ./...

Contributions, bug reports, and feature requests are welcome. See CONTRIBUTING.md, the Code of Conduct, and the Security Policy.

Scope and limitations

• Website crawling is static and limited to the main page; the tool does not run a browser or execute JavaScript.
• Runtime-generated chunk paths, inline data: source maps, and indexed sections maps are not supported yet.
• Inlining is limited to static string arrays near the start of a file and simple top-level getters. It helps scanning but does not prove runtime behavior.
• Response limits: HTML 16 MiB, JavaScript 512 MiB, source maps 64 MiB, and AST input 25 MiB. Long minified lines are still scanned in chunks.
• Random 150–300 ms request delays and browser headers reduce request rate but cannot guarantee a server will accept a scan.

License

MIT. See LICENSE.