Decompiling the Web: Automated Semantic Recovery of Post-compilation Abstraction Leaks

Abstract

Modern web applications rely on advanced compilation pipelines to transform high-level source code into heavily optimized execution bundles. This structural transformation introduces a systemic security gap that we formalize as Post-Compilation Semantic Collapse. During the build process, the application state is fractured into disjointed execution fragments, and dependencies are subsequently orchestrated via dynamic runtime engines. While developers operate under the assumption of server-client isolation, modern bundlers can weaken this boundary to optimize performance, silently migrating sensitive backend context and internal routing logic into public client-side artifacts. Traditional security scanners are poorly matched to these architectural exposures. By evaluating compiled JavaScript as a flat, static resource, existing tools fail to reconstruct dynamic dependency graphs or interpret the proprietary streaming protocols required to map the modern attack surface. To overcome this structural gap, we introduce JS Recon, an automated semantic recovery framework that performs decompiler-like analysis for modern JavaScript bundles. Because bundlers obscure execution paths using cryptographic hashes and functionally transformed arrays, pure static parsing is insufficient. JS Recon defeats this obfuscation by coupling static structural analysis with targeted dynamic execution. Specifically, it statically lifts heavily minified payloads into an Abstract Syntax Tree (AST) to isolate obfuscated routing logic, and subsequently evaluates these localized runtime dictionaries within a dynamic native sandbox. Furthermore, to resolve decentralized server-side dependencies, the pipeline actively manipulates proprietary React Server Component (RSC) streaming protocols, forcing the backend to dynamically serialize and expose routing state not present in static artifacts. We deployed JS Recon against the Tranco Top 1M domains to execute a large-scale measurement study. Our pipeline extracted over 2.5 million orphaned sourcemaps, achieving a 97.04% extraction rate in controlled environments compared to 0% for baseline tools. Furthermore, JS Recon recovered 6,210 verified secret instances, establishing a 6.6x discovery multiplier over the leading reconnaissance spider. Our measurement identifies a widespread ecosystem issue, finding 447 globally unique verified secrets distributed across 379 root domains. This study shows that automated semantic recovery is needed to audit build artifacts and map the obscured attack surfaces of modern web deployments.