notte-sdk@1.10.3
TypeScript SDK for Notte - Cloud-hosted browser sessions and automation
AI Security Review
scanned 1d ago · by lpm-firewall-aiClient construction triggers a background version lookup that sends package and version information to the npm registry. Because this runtime telemetry is not disclosed in the reviewed package metadata, classify it as suspicious under the telemetry rule.
Decision evidence
public snapshot- Constructing a Notte client calls startVersionCheck, which schedules an asynchronous version lookup.
- The lookup requests the package’s latest version from registry.npmjs.org and sends the package name and SDK version in the user agent.
- The lookup can be disabled with NOTTE_SDK_DISABLE_VERSION_CHECK; it is also skipped in tests and CI.
- The request contains package and version information, with no evidence that it sends credentials, environment values, or project data.
- The check supports the SDK’s version warning feature and does not run from an install hook.
Source & flagged code
4 flaggedPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/index.jsView on unpkg · L4273This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkgConstructing a Notte client calls startVersionCheck, which schedules an asynchronous version lookup.
Findings
Affected versions and remediation
This report applies to notte-sdk@1.10.3.
See all versions of notte-sdk for other recorded verdicts.
- Review the evidence and your use of notte-sdk@1.10.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.