Since our employer has a physical access to the server that runs our node.js project, we are worried about the js files that can be owned and copied to another server (even after obfuscation).
Then is there a way to prevent the JavaScript code from being executed on another system?
My idea is to check some systems information to know if it's the right server.
You can try node-machine-id and javascript-obfuscator.
The former allows you to generate a device fingerprint that you can embed into the software for verifying.
The latter allows you to obfuscate the code so it is not editable or readable by users with access to the file system.
And yes, node-machine-id does not work if the environment is virtualized, like a VM or container