← Home

puppeteer-core

npm Repository Homepage

A high-level API to control headless Chrome over the DevTools Protocol

100
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

mathiasgoogle-wombot

Keywords

puppeteerchromeheadlessautomation

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Publisher changed from google-wombot to GitHub Actions CI/CD with SLSA provenance attestation — this reflects a legitimate migration to automated, attested releases for the official puppeteer project. ai
semgrep semgrep:child-process-import AI (semgrep): puppeteer-core legitimately uses child_process to spawn ffmpeg for screen recording; this is a documented, expected feature of the package. ai
provenance no-provenance AI (provenance): Established Google-maintained package; lack of Sigstore provenance is not a meaningful risk signal here. ai
semgrep semgrep:base64-decode AI (semgrep): Decodes base64 binary data from Chrome DevTools Protocol event streams — standard, expected behavior for a browser automation library. Not a malicious payload risk. ai
semgrep semgrep:new-function-constructor AI (semgrep): Core Puppeteer feature for serializing user-supplied JS functions to execute in browser contexts (page.evaluate etc.). Intentional and documented API behavior, not a security risk. ai

Versions (showing 100 of 341)

Version Deps Published
25.4.0 6 / 7
25.3.0 6 / 7
25.2.1 6 / 7
25.2.0 6 / 7
25.1.0 6 / 7
25.0.4 7 / 8
25.0.3 7 / 8
25.0.2 7 / 8
25.0.1 7 / 8
24.43.1 7 / 8
24.43.0 7 / 8
24.42.0 7 / 8
24.41.0 7 / 7
24.40.0 7 / 7
24.39.1 7 / 7
24.39.0 7 / 7
24.38.0 7 / 7
24.37.5 7 / 7
24.37.4 7 / 7
24.37.3 7 / 7
24.37.2 7 / 7
24.37.1 7 / 7
24.37.0 7 / 7
24.36.1 7 / 7
24.36.0 7 / 7
24.35.0 7 / 7
24.34.0 7 / 7
24.33.1 7 / 7
24.33.0 7 / 7
24.32.1 7 / 7
24.32.0 7 / 7
24.31.0 7 / 7
24.30.0 7 / 7
24.29.1 7 / 7
24.29.0 7 / 7
24.28.0 7 / 7
24.27.0 7 / 7
24.26.1 7 / 7
24.26.0 7 / 7
24.25.0 7 / 7
24.24.1 7 / 7
24.24.0 7 / 7
24.23.1 7 / 7
24.23.0 7 / 7
24.22.3 7 / 7
24.22.2 7 / 7
24.22.1 7 / 7
24.22.0 7 / 7
24.21.0 7 / 7
24.20.0 7 / 7
24.19.0 6 / 7
24.18.0 6 / 7
24.17.1 6 / 7
24.17.0 6 / 7
24.16.2 6 / 7
24.16.1 6 / 7
24.16.0 6 / 7
24.15.0 6 / 7
24.14.0 6 / 7
24.13.0 6 / 7
24.12.1 6 / 7
24.12.0 6 / 7
24.11.2 6 / 7
24.11.1 6 / 7
24.11.0 6 / 7
24.10.2 6 / 7
24.10.1 6 / 7
24.10.0 6 / 7
24.9.0 6 / 7
24.8.2 6 / 7
24.8.1 6 / 7
24.8.0 6 / 7
24.7.2 6 / 7
24.7.1 6 / 7
24.7.0 6 / 7
24.6.1 6 / 7
24.6.0 6 / 7
24.5.0 6 / 7
24.4.0 6 / 7
24.3.1 6 / 7
24.3.0 6 / 7
24.2.1 6 / 7
24.2.0 6 / 7
24.1.1 6 / 7
24.1.0 6 / 7
24.0.0 6 / 7
23.11.1 6 / 7
23.11.0 6 / 7
23.10.4 6 / 7
23.10.3 6 / 7
23.10.2 6 / 7
23.10.1 6 / 7
23.10.0 6 / 7
23.9.0 6 / 7
23.8.0 6 / 7
23.7.1 6 / 7
23.7.0 6 / 7
23.6.1 6 / 7
23.6.0 6 / 7
23.5.3 6 / 7
Showing 100 of 341 Next page →

v25.4.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v25.3.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.