puppeteer@25.16.0

⚠ Under review

A high-level API to control headless Chrome over the DevTools Protocol

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The inspected postinstall path is browser setup and has a skip-download setting. The required puppeteer-core runtime dependency was unresolved in the supplied snapshot, so its behavior cannot be assessed from source and a clean verdict is not supported.

Static reason

One or more suspicious static signals were detected.

Trigger

The package postinstall hook runs the browser installer.

Impact

The available source does not establish malicious behavior, but the unresolved dependency prevents a complete source-based assessment.

Mechanism

The installer calls the browser download routine; it also imports revision data from the unresolved puppeteer-core dependency.

AI rationale

Evidence

package.jsonlib/puppeteer/node/install.jslib/puppeteer/node/cli.jsinstall.mjs

Decision evidence

public snapshot

AI called this Manual Review at 87.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest declares a postinstall hook that runs the installer.
The installer calls the browser download routine, which honors a skip-download setting.
The manifest pins puppeteer-core, and both the installer and CLI import it; its source was unresolved in the supplied dependency snapshot.

Evidence against

The inspected install path performs browser setup and provides a setting to skip downloads; no attack behavior was identified in the inspected excerpts.

Behavioral surface

Source

EnvironmentVars

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 23.0 KB of source

Source & flagged code

8 flagged

package.jsonView file

Lines 22-62json

22 "./internal/*": {

23 "import": "./lib/puppeteer/*",

24 "require": "./lib/puppeteer/*"

25 },

26 "./*": {

27 "import": "./*",

28 "require": "./*"

29 }

30 },

31 "repository": {

32 "type": "git",

33 "url": "https://github.com/puppeteer/puppeteer/tree/main/packages/puppeteer"

34 },

35 "engines": {

36 "node": ">=22.12.0"

37 },

38 "scripts": {

39 "build:docs": "wireit",

40 "build": "wireit",

41 "clean": "../../tools/clean.mjs",

42 "postinstall": "node install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 "prepack": "wireit",

44 "unit": "wireit",

45 "unit:only": "wireit"

Low

Suspicious Lifecycle Evidence

The manifest declares a postinstall hook that runs the installer.

package.jsonView on unpkg · L42

46 },

47 "wireit": {

48 "prepack": {

49 "command": "node --experimental-strip-types ../../tools/cp.ts ../../README.md README.md",

50 "files": [

51 "../../README.md"

52 ],

53 "output": [

54 "README.md"

55 ]

56 },

57 "build": {

58 "dependencies": [

59 "build:tsc",

60 "build:types"

61 ]

62 },

Lines 119-146json

119 "install.mjs",

120 "!*.test.ts",

121 "!*.test.js",

122 "!*.test.d.ts",

123 "!*.test.js.map",

124 "!*.test.d.ts.map",

125 "!*.docs.ts",

126

install.mjsView file

Lines 19-44javascript

19/**

20 * @returns {import("puppeteer/internal/node/install.js")}

21 */

22async function importInstaller() {

23 try {

24 return await import(

lib/puppeteer/node/install.jsView file

Lines 1-57javascript

1/**

2 * @license

4 * SPDX-License-Identifier: Apache-2.0

5 */

6import { install, Browser, resolveBuildId, detectBrowserPlatform, } from '@puppeteer/browsers';

7import { PUPPETEER_REVISIONS } from 'puppeteer-core/internal/revisions.js';

lib/puppeteer/node/cli.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2/**

3 * @license

5 * SPDX-License-Identifier: Apache-2.0

6 */

7import { CLI, Browser } from '@puppeteer/browsers';

8import { PUPPETEER_REVISIONS } from

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

42"postinstall": "node install.mjs", "prepack": "wireit", "unit": "wireit", "uni

Low

Suspicious Lifecycle Evidence

The manifest declares a postinstall hook that runs the installer.

package.jsonView on unpkg · L42

139"puppeteer-core": "25.16.0", "typed-query-selector": "^2.12.3" }, "devDependencies": { "@types/node": "^18.1

Low

Suspicious Dependency Evidence

Findings

1 High2 Medium8 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

LowScripts Present

LowHigh Entropy Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidenceinstall.mjs

LowAi Review Evidencelib/puppeteer/node/install.js

LowSuspicious Dependency Evidencepackage.json

LowSuspicious Dependency Evidencelib/puppeteer/node/install.js

LowSuspicious Dependency Evidencelib/puppeteer/node/cli.js

Affected versions and remediation

This report applies to puppeteer@25.16.0.

See all versions of puppeteer for other recorded verdicts.

Review the evidence and your use of puppeteer@25.16.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 11:55:45.242Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.