The Hidden DNA of LLM-Generated JavaScript: Structural Patterns Enable High-Accuracy Authorship Attribution

In this paper, we present the first large-scale study exploring whether JavaScript code generated by Large Language Models (LLMs) contains distinguishable fingerprints enabling reliable model attribution. As developers increasingly rely on third-party AI aggregators, verifying the identity of the serving model is critical for vulnerability detection, API integrity and detecting model-routing discrepancies in the software supply chain. We introduce LLM-NodeJS, a dataset of 50,000 Node.js back-end programs from 20 large language models. For each code, minified, mangled, obfuscated and deobfuscated versions are created yielding 250,000 unique JavaScript samples. JSIR and AST versions are also added for further research. Using this dataset, we propose CodeT5-JSA, a custom encoder-only architecture that achieves 95.8% accuracy on five-class attribution and 88.5% on twenty-class tasks, significantly outperforming BERT and CodeBERT baselines. Crucially, our evaluation on unseen code shows only a marginal 3–6% performance drop, confirming that the model captures persistent structural fingerprints rather than memorizing task-specific patterns. We further demonstrate that these structural signals survive aggressive obfuscation. To support open science, we release the dataset, training scripts, and models on GitHub: https://github.com/LLM-NodeJS-dataset.