ElectronJS code protection 2018

tl;dr You can and it is not worth the effort. Just pack your source into an asar file, it keeps most people away from it.

Long answer:

• Use the asar option when building your app.
• Obfuscate the code with an uglifier.
• Use WASM
• Language bindings to grab your data from a compiled format
  • neonjs for Rust
  • edge-js for C#
  • N-API, NAN for C/C++

Otherwise, your files are scripts, all these steps only slow down an attacker (tactic of many defenses), but they will not prevent them from accessing them. The devTools are fairly easy to get opened and people will be able to read the code in some way, shape or form. And if someone gets your obfuscated code, it is simple to reconstruct what is happening (see here for reference: https://www.youtube.com/watch?v=y6Uzinz3DRU)

If you want to protect yourself from code manipulation, there are better ways to do it, like Hashing, Context Isolation etc. Electron has a whole chapter on the matter.

https://github.com/electron/electron/blob/master/docs/tutorial/security.md

Small Update (2020):

I've seen this library a few weeks ago and thought it would show a nice way to further obfuscate the code from being read by external parties

https://github.com/OsamaAbbas/bytenode

The basic idea is to compile the JS into bytecode for V8. This works very well for Electron and is definitely a hurdle not everyone will get over. But, this will not protect your code from being turned back into readable JS. It's just another layer of protection to make it more difficult.