Set vmTargetFunctionsMode: 'comment' to only VM-obfuscate functions decorated with a special comment. Works at any nesting level.

function regularFunction() {
    return 'not virtualized';
}

/* javascript-obfuscator:vm */
function sensitiveFunction() {
    return 'this will be VM-protected';
}

class MyClass {
    /* javascript-obfuscator:vm */
    sensitiveMethod() {
        return 'method will be VM-protected';
    }
}

Only root-level functions are considered. Use vmTargetFunctions to allow-list or vmExcludeFunctions to exclude functions by name.

// Protect only these specific functions
{
    vmObfuscation: true,
    vmTargetFunctions: ['validateLicense', 'checkAuth']
}

// Or protect everything EXCEPT these
{
    vmObfuscation: true,
    vmExcludeFunctions: ['render', 'animate']
}

Add "use strict"; at the top of your file to enable strict mode for all code:

"use strict";

function validateLicense(key) {
    // This function runs in strict mode
    return key.length === 32;
}

function processPayment(amount) {
    // This also runs in strict mode
    return amount * 1.1;
}

Add "use strict"; inside specific functions if only certain functions need strict mode:

/* javascript-obfuscator:vm */
function sensitiveFunction() {
    "use strict";
    // Only this function runs in strict mode
    return this === undefined; // true in strict mode
}

function regularFunction() {
    // This runs in non-strict mode
    return this; // global object
}