registry / puppeteer / 25.4.0

puppeteer@25.4.0

A high-level API to control headless Chrome over the DevTools Protocol

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No confirmed malicious attack surface. Installation can download configured browser binaries, which is Puppeteer's documented package function.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall, or explicit puppeteer CLI use.

Impact

Downloads browser artifacts when download is not disabled; no source evidence of data theft or unauthorized system/control-surface mutation.

Mechanism

Configured browser download and cache setup.

Rationale

The lifecycle hook is a package-aligned browser provisioning step with user-configurable skip, proxy, cache, and download settings. Source inspection found no concrete malicious behavior.

Evidence

package.jsoninstall.mjslib/puppeteer/node/install.jslib/puppeteer/getConfiguration.jslib/puppeteer/node/cli.jslib/puppeteer/puppeteer.js

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json postinstall only runs node install.mjs.

puppeteer@25.4.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code