notte-sdk@1.10.4
TypeScript SDK for Notte - Cloud-hosted browser sessions and automation
AI Security Review
scanned 14h ago · by lpm-firewall-aiThe source shows an automatic, opt-out version lookup to the npm registry when a client is constructed. It sends package/version information rather than credentials or project data, but the runtime lookup is not clearly disclosed in the inspected package metadata, so classify it as warning-level telemetry.
Decision evidence
public snapshot- Constructing a NotteClient starts an asynchronous version check.
- The check requests the latest notte-sdk version from registry.npmjs.org and sends the package name and SDK version in its User-Agent.
- The check can be disabled with NOTTE_SDK_DISABLE_VERSION_CHECK; it is also skipped in CI and test environments.
- The package describes itself as a TypeScript SDK for Notte’s cloud browser sessions and automation.
- The SDK’s default API endpoint is api.notte.cc, matching the package’s stated service.
- The package’s prepublishOnly script only runs the build; no install lifecycle hook is declared.
Source & flagged code
4 flaggedPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/index.jsView on unpkg · L4273Constructing a NotteClient starts an asynchronous version check.
dist/index.jsView on unpkg · L6245The check requests the latest notte-sdk version from registry.npmjs.org and sends the package name and SDK version in its User-Agent.
Findings
Affected versions and remediation
This report applies to notte-sdk@1.10.4.
See all versions of notte-sdk for other recorded verdicts.
- Review the evidence and your use of notte-sdk@1.10.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.