registry / Telemetry / notte-sdk

notte-sdk

TypeScript SDK for Notte - Cloud-hosted browser sessions and automation

This report shows the evidence for notte-sdk@1.10.4. 0 of 15 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 15h ago · by lpm-firewall-ai

The source shows an automatic, opt-out version lookup to the npm registry when a client is constructed. It sends package/version information rather than credentials or project data, but the runtime lookup is not clearly disclosed in the inspected package metadata, so classify it as warning-level telemetry.

Static reason

One or more suspicious static signals were detected.

Trigger

Constructing a NotteClient in a runtime where version checks are enabled.

Impact

The registry receives a version lookup and the requester’s ordinary network metadata. The check can be disabled with NOTTE_SDK_DISABLE_VERSION_CHECK.

Mechanism

A background request queries the npm registry for the latest notte-sdk release. It sends the package name and version in the User-Agent, then uses the response to support upgrade warnings.

AI rationale

Network endpoints2

registry.npmjs.org/notte-sdk/latestapi.notte.cc

Decision evidence

public snapshot

AI called this Suspicious at 79.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Constructing a NotteClient starts an asynchronous version check.
The check requests the latest notte-sdk version from registry.npmjs.org and sends the package name and SDK version in its User-Agent.
The check can be disabled with NOTTE_SDK_DISABLE_VERSION_CHECK; it is also skipped in CI and test environments.

Evidence against

The package describes itself as a TypeScript SDK for Notte’s cloud browser sessions and automation.
The SDK’s default API endpoint is api.notte.cc, matching the package’s stated service.
The package’s prepublishOnly script only runs the build; no install lifecycle hook is declared.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 539 KB of source, external domains: api.notte.cc, docs.notte.cc, github.com, registry.npmjs.org

Source & flagged code

4 flagged

dist/index.jsView file

4273package = notte-sdk; repositoryIdentity = notte; dependency = tldts L4273: // src/vaults.ts L4274: var import_tldts = require("tldts"); L4275: var CREDENTIAL_FIELDS = ["email", "username", "mfa_secret", "password"];

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L4273

6245releaseDeadline(request); } }); this.client.interceptors.error.use((error, response, request) => { releaseDeadline(request); return this.toTypedError(error, response, request); }); startVersionCheck(); } /** * Map

Medium

Ai Review Evidence

Constructing a NotteClient starts an asynchronous version check.

dist/index.jsView on unpkg · L6245

307st response = await fetchFn(`https://registry.npmjs.org/${encodeURIComponent(packageName)}/latest`, { headers: { accept: "application/json", "user-agent": `${packageName}/${SDK_VERSION} (https://github.com/nottelabs/notte)` }, signal: controller?

Medium

Ai Review Evidence

The check requests the latest notte-sdk version from registry.npmjs.org and sends the package name and SDK version in its User-Agent.

Findings

1 High6 Medium5 Low

HighCopied Package Dependency Bridgedist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumAi Review Evidencedist/index.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to notte-sdk@1.10.4.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of notte-sdk@1.10.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-04 07:46:49.129Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

15 known versions

1.10.4latestshownSuspiciousTelemetryWarnPublishedNov 4, 2026, 7:38 AM 1.10.3SuspiciousTelemetryWarnPublishedNov 3, 2026, 10:36 PM 1.10.1Clean—AllowPublishedOct 27, 2026, 4:01 PM 1.10.0Clean—AllowPublishedOct 23, 2026, 3:24 PM

registry / Telemetry / notte-sdk

notte-sdk

TypeScript SDK for Notte - Cloud-hosted browser sessions and automation

This report shows the evidence for notte-sdk@1.10.4. 0 of 15 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 15h ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.

Trigger

Constructing a NotteClient in a runtime where version checks are enabled.

Impact

The registry receives a version lookup and the requester’s ordinary network metadata. The check can be disabled with NOTTE_SDK_DISABLE_VERSION_CHECK.

Mechanism

A background request queries the npm registry for the latest notte-sdk release. It sends the package name and version in the User-Agent, then uses the response to support upgrade warnings.

AI rationale

Network endpoints2

registry.npmjs.org/notte-sdk/latestapi.notte.cc

Decision evidence

public snapshot

AI called this Suspicious at 79.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Constructing a NotteClient starts an asynchronous version check.
The check requests the latest notte-sdk version from registry.npmjs.org and sends the package name and SDK version in its User-Agent.
The check can be disabled with NOTTE_SDK_DISABLE_VERSION_CHECK; it is also skipped in CI and test environments.

Evidence against

The package describes itself as a TypeScript SDK for Notte’s cloud browser sessions and automation.
The SDK’s default API endpoint is api.notte.cc, matching the package’s stated service.
The package’s prepublishOnly script only runs the build; no install lifecycle hook is declared.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 539 KB of source, external domains: api.notte.cc, docs.notte.cc, github.com, registry.npmjs.org

Source & flagged code

4 flagged

dist/index.jsView file

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L4273

Medium

Ai Review Evidence

Constructing a NotteClient starts an asynchronous version check.

dist/index.jsView on unpkg · L6245

Medium

Ai Review Evidence

The check requests the latest notte-sdk version from registry.npmjs.org and sends the package name and SDK version in its User-Agent.

Findings

1 High6 Medium5 Low

HighCopied Package Dependency Bridgedist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumAi Review Evidencedist/index.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to notte-sdk@1.10.4.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of notte-sdk@1.10.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-04 07:46:49.129Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

15 known versions