puppeteer@25.12.0

A high-level API to control headless Chrome over the DevTools Protocol

AI Security Review

scanned 28d ago · by lpm-firewall-ai

Static inspection found a normal Puppeteer install-time browser downloader and library entry point, with no concrete malicious behavior. The lifecycle network activity is package-aligned and configurable.

Static reason

One or more suspicious static signals were detected.

Trigger

Package installation triggers the declared post-install hook.

Impact

No malicious behavior, credential collection, foreign configuration changes, or destructive action was found.

Mechanism

The hook loads the internal installer, which may download configured browsers unless downloading is disabled.

AI rationale

Evidence

install.mjslib/puppeteer/node/install.js

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes the Puppeteer library and CLI entry points.
The post-install hook invokes only the package browser downloader.
The downloader reads configuration and honors its skip-download setting before downloading browsers.

Evidence against

Behavioral surface

Source

EnvironmentVars

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 23.0 KB of source

Source & flagged code

6 flagged

package.jsonView file

Lines 1-62json

2 "name": "puppeteer",

3 "version": "25.12.0",

4 "description": "A high-level API to control headless Chrome over the DevTools Protocol",

5 "keywords": [

6 "puppeteer",

7 "chrome",

8 "headless",

9 "automation"

10 ],

11 "type": "module",

12 "bin": "./lib/puppeteer/node/cli.js",

13 "main": "./lib/puppeteer/puppeteer.js",

14 "module": "./lib/puppeteer/puppeteer.js",

15 "types": "./lib/types.d.ts",

16 "exports": {

17 ".": {

18 "types": "./lib/types.d.ts",

Low

Ai Review Evidence

The manifest exposes the Puppeteer library and CLI entry points.

package.jsonView on unpkg · L11

19 "import": "./lib/puppeteer/puppeteer.js",

20 "require": "./lib/puppeteer/puppeteer.js"

21 },

22 "./internal/*": {

23 "import": "./lib/puppeteer/*",

24 "require": "./lib/puppeteer/*"

25 },

26 "./*": {

27 "import": "./*",

28 "require": "./*"

29 }

30 },

31 "repository": {

32 "type": "git",

33 "url": "https://github.com/puppeteer/puppeteer/tree/main/packages/puppeteer"

34 },

35 "engines": {

36 "node": ">=22.12.0"

37 },

38 "scripts": {

39 "build:docs": "wireit",

40 "build": "wireit",

41 "clean": "../../tools/clean.mjs",

42 "postinstall": "node install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 "prepack": "wireit",

44 "unit": "wireit",

45 "unit:only": "wireit"

Low

Suspicious Lifecycle Evidence

The post-install hook invokes only the package browser downloader.

package.jsonView on unpkg · L42

46 },

47 "wireit": {

48 "prepack": {

49 "command": "node --experimental-strip-types ../../tools/cp.ts ../../README.md README.md",

50 "files": [

51 "../../README.md"

52 ],

53 "output": [

54 "README.md"

55 ]

56 },

57 "build": {

58 "dependencies": [

59 "build:tsc",

60 "build:types"

61 ]

62 },

install.mjsView file

Lines 18-44javascript

19/**

20 * @returns {import("puppeteer/internal/node/install.js")}

21 */

22async function importInstaller() {

23 try {

24 return await

lib/puppeteer/node/install.jsView file

Lines 14-54javascript

14 const result = await install({

15 browser,

16 cacheDir,

17 platform,

18 buildId,

19 downloadProgressCallback: 'default',

20 baseUrl,

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

11"type": "module", "bin": "./lib/puppeteer/node/cli.js", "main": "./lib/puppeteer/puppeteer.js", "module": "./lib/puppeteer/puppeteer.js", "types": "./lib/types.d.ts", "exports": { ".": { "types": "./lib/types

Low

Ai Review Evidence

The manifest exposes the Puppeteer library and CLI entry points.

package.jsonView on unpkg · L11

42"postinstall": "node install.mjs", "prepack": "wireit", "unit": "wireit", "unit:only": "

Findings

1 High2 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

LowScripts Present

LowHigh Entropy Strings

LowAi Review Evidencepackage.json

LowSuspicious Lifecycle Evidencepackage.json

LowSuspicious Lifecycle Evidenceinstall.mjs

LowAi Review Evidencelib/puppeteer/node/install.js

Affected versions and remediation

This report applies to puppeteer@25.12.0.

See all versions of puppeteer for other recorded verdicts.

Review the evidence and your use of puppeteer@25.12.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-28 03:01:32.973Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.