Extract JavaScript from Bun-compiled executables
The easiest Bun decompiler-style JavaScript extractor for reverse engineering, malware analysis, security research, and code recovery.
Why It Exists | Quick Start | Features | Real-World Samples | How It Works
unbuned is a zero-dependency Python extractor for Bun-compiled executables. It locates the embedded Bun bundle, strips the binary noise around it, and writes clean JavaScript back to disk.
If you want to reverse engineer a Bun CLI, inspect a suspicious Bun-packed binary, recover lost app logic, or study how a production Bun app is bundled, this is the tool.
I built unbuned for the exact moment where a Bun executable lands on disk and you do not want a full reverse-engineering project just to see the application logic. Most of the time, the thing you actually need is the JavaScript bundle, fast, with as little friction as possible.
That is the whole point of this repo: one Python file, no dependencies, no install ceremony, and output you can immediately grep, diff, beautify, or audit.
If this tool saves you time, star the repo. That is what helps it reach more reversers, researchers, and malware analysts.
git clone https://github.com/vibheksoni/unbuned.git
cd unbunedNo dependencies required. Just Python 3.6+.
python unbuned.py <path-to-bun-executable>Examples:
python unbuned.py droid.exe
python unbuned.py claude.exe
python unbuned.py freebuffOutput lands here:
output/<executable-name>/<executable-name>.js
- Extract JavaScript from Bun-compiled executables with pure Python 3.6+
- Parse Windows PE
.bunsections directly - Parse macOS Mach-O
__BUN,__bunsections directly - Fall back to Bun magic-byte discovery when section metadata is unavailable
- Detect JavaScript boundaries and strip binary contamination
- Refine extraction boundaries with
debugId,sourceMappingURL, and closure markers - Save clean UTF-8 JavaScript to
output/<name>/<name>.js - Stay readable, hackable, and dependency-free
unbuned currently handles:
- Windows PE Bun executables
- macOS thin Mach-O Bun executables
- Other Bun-packed binaries when the bundle can be located through the Bun magic-byte fallback
It does not yet implement native ELF section parsing or FAT/universal Mach-O extraction.
Run the executable through unbuned:
python unbuned.py droid.exeOutput
Extracted: output/droid/droid.js
Size: 14,234,567 bytes
The extracted JavaScript will be saved to output/<executable-name>/<executable-name>.js.
This repo includes extracted bundles from real Bun applications so people can immediately see what unbuned pulls out of production binaries.
Current proof set: 3 real targets, 36+ MB of extracted JavaScript, all committed in output/.
- Extracted: 14.1 MB of JavaScript
- Contains: agent logic, model configuration, application workflows
- Location:
output/droid/droid.js
- Extracted: 10.9 MB of JavaScript
- Contains: Anthropic SDK code, tool definitions, CLI internals
- Location:
output/claude/claude.js
- Extracted: 11.4 MB of JavaScript
- Contains: telemetry events, model routing, product and CLI flows
- Location:
output/freebuff/freebuff.js
These samples are the proof point. unbuned is built to rip useful code out of real shipped Bun executables, not just synthetic fixtures.
Reverse-engineering tools live or die on credibility. Including extracted bundles from Droid, Claude Code, and Freebuff makes the value concrete:
- you can inspect real output before running the tool
- you can use the repo as a search surface for Bun internals
- you can verify that the extraction stays readable at multi-megabyte scale
- you can benchmark your own reversing workflow against real targets
When extraction succeeds, you get:
- a clean
.jsfile on disk - UTF-8 text without the surrounding binary junk
- output that is ready for grep, static analysis, beautification, or manual review
That makes unbuned useful for both fast triage and deeper reversing sessions.
If you want to judge the extractor before running it yourself, open the sample outputs in output/ and search through them. The repo is meant to prove the claim, not just make it.
unbuned uses a multi-stage extraction process:
- Format Detection: detect the executable container and choose the best extraction path.
- Section Discovery: locate
.bunin PE files or__BUN,__bunin thin Mach-O files. - Magic-Byte Fallback: search for the Bun bundle marker when section metadata is not enough.
- JavaScript Marker Detection: find the
// @bunmarker that denotes the bundle start. - Boundary Detection: measure non-printable byte ratios to find the transition from code to binary data.
- Boundary Refinement: use markers like
//# debugId=,//# sourceMappingURL=, and})();to stop cleanly. - Extraction: decode the recovered JavaScript and write it to
output/<name>/<name>.js.
The extractor uses a practical heuristic tuned for real Bun payloads:
- analyzes chunks for non-printable character ratios
- looks for source map comments (
//# sourceMappingURL=) - detects debug markers (
//# debugId=) - identifies IIFE closures (
})();) - validates binary-looking data after potential boundaries
- Reverse Engineering: understand how a Bun application works without building a full decompiler first
- Security Research: inspect shipped Bun executables for risky logic, secrets, or attack surface
- Malware Analysis: peel back Bun-packed droppers, loaders, or suspicious tooling
- Code Recovery: recover source when the original project is gone but the executable survives
- Learning: study how real Bun apps package code, dependencies, and runtime behavior
- CTF / Challenge Work: speed up bundle extraction during time-boxed reversing tasks
- Python 3.6 or higher
- No external dependencies
- Extracts bundled JavaScript only, not native modules or assets
- Native ELF parsing is not implemented yet
- FAT/universal Mach-O binaries are not supported yet
- Minified code remains minified
- Some obfuscated code will still require manual analysis
Contributions are welcome, especially around:
- ELF support
- more fixture coverage
- better boundary heuristics
- additional real-world Bun samples
Bug reports, PRs, and extraction results are all useful.
This tool is meant for legitimate reverse engineering, malware analysis, security research, learning, and recovery work. Respect licenses, contracts, and local law. Use it responsibly.
- asar - Extract Electron
app.asararchives - pkg - Package Node.js apps into executables
- nexe - Create standalone Node.js executables
Built for people who would rather read the Bun app than speculate about it
Star this repo if you find it useful.
MIT License - see LICENSE for details.
If this repo helps you crack open a Bun executable faster, that is exactly what it was built for.
Currently open to work. If you're looking for someone with security research, reverse engineering, malware analysis, or full-stack development experience, hit me up.
- X/Twitter: @ImVibhek
- Website: vibheksoni.com
- Security Blog: opendoors.wtf
- GitHub: vibheksoni
Remember: with great power comes great responsibility. Use this tool ethically and legally.