一句话：提出 D-Bundlr，用代码变换、静态分析、机器学习与动态验证解包 JS bundle 并恢复库源码，以提升静态分析效果。
JavaScript 静态分析在漏洞检测中已被广泛研究，但现有方法通常忽略打包（bundling）这一类似编译的开发实践。打包会合并不同来源代码并进行优化，导致单个字母标识符复用和动态特性模拟依赖，从而阻碍静态分析。本文提出一种逆向工程方法：利用领域特定代码变换解包 bundle，并将重新识别的库替换为其源代码。D-Bundlr 结合轻量静态分析将 bundle 拆分为组件、机器学习识别库，以及动态分析验证识别结果。作者实现该工具，并通过比较 CodeQL 在 debundling 前后的输出进行评估。
Static analysis for vulnerability detection in JavaScript is an extensively studied research area. However, state-of-the-art approaches ignore bundling, an emerging development practice, akin to compilation, which allows developers to merge code from different providers, while also applying optimizations to reduce code size. A typical bundle heavily reuses single-letter identifiers and extensively relies on dynamic JavaScript features to emulate code dependencies, thus, hindering static analysis. In this work, we propose a reverse engineering approach that relies on domain-specific code transformations to unpack bundles and replace reidentified libraries with their source code. Our technique applies lightweight static analysis to dissect bundles into individual components, machine learning to identify libraries, and dynamic analysis to verify that libraries were correctly identified. We implement this approach in a tool called D-Bundlr, and evaluate it by comparing the output of CodeQL (a popular static analysis tool) before and after debundling.