Are the IP risks too big or can they be mitigated by using obfuscation?
As in any business, the most important aspect is finding customers. First of all, you need to have an idea and then a product. It needs to be really good unless you have some exceptional marketing and sales skills ;).
Then, you'll need to find potential customers. You can do that directly or promote yourself in various ways. Many companies open source their products or parts of their products. This may attract a lot of attention and makes you and your software more recognizable. If you open source a big part of your product you also won't have a problem with obfuscating the code – it's available out there anyway.
But how to make money if you open sourced everything? That's why I'm talking about a product, not a library. Source code is not everything (unless it's a really simple thing, but then you wouldn't sell it anyway). You can propose additional support, commercial licenses, knowledge and experience (in various ways such as custom development or your assistance). Some developers also try to crowd fund their projects on services like https://www.patreon.com/ or https://gratipay.com/ but you need a really big community to live from that.
So, if you want to make money, then in most cases you should start thinking about a product, not a library itself. You need to be prepared that a big fraction of your time will be spent on things other than coding. This is tough for many developers.
Good luck! :)
https://gratipay.news/integrating-npm-39333109419d https://gratipay.news/pay-for-your-package-json-cb07341445ca
If you claim your npm packages on Gratipay then you'll be ready as we start bringing companies online to pay: