What did nittim read in alibaba/page-agent?

nittim read 233 of 233 eligible files in alibaba/page-agent. The reading ran on October 15, 2026. It was taken at commit 9eb6b66.

Did nittim find committed secrets or vulnerable dependencies in alibaba/page-agent?

The rule-based scan found 0 committed secrets and 2 vulnerable dependencies in alibaba/page-agent. Affected: @modelcontextprotocol/sdk (GHSA-6qxp-vccf-f47h), proxy-addr (GHSA-jqcg-44mw-7w3h).

← Browse the report library

a public repository, read by nittim

Is alibaba/page-agent production ready?

What nittim read in this repository, and what it found. Public repository, public reading — sourced from its own code and dependency manifests, nothing else.

JavaScript in-page GUI agent. Control web interfaces with natural language.

TypeScript · 29.4k stars · last push October 14, 2026

alibaba/page-agent is a TypeScript repository that provides a JavaScript in-page GUI agent for controlling web interfaces with natural language. The project enables developers to interact with web applications programmatically through natural language commands.

nittim scanned 233 files in alibaba/page-agent and found evidence of concern. The scan identified 2 vulnerable runtime dependencies. The vulnerable package @modelcontextprotocol/sdk has advisory GHSA-6qxp-vccf-f47h. The vulnerable package proxy-addr has advisory GHSA-jqcg-44mw-7w3h.

To address these findings, rescan the repository after updating the vulnerable dependencies to patched versions. Then run a full audit to understand the specific issues associated with each advisory and determine what changes are needed to resolve them.

Written from nittim's own scan on October 15, 2026; rescanned when the repository changes.

No verdict. The rule-based check reports hard evidence, or reports that it found none. Neither is a judgment on whether this code is safe to ship.

What was read — rule-based scan

Rule-based checks run on nittim's servers — a secret scanner and a dependency check, no model in the path. The code reached those two and stopped there.

Read 233 of 233 eligible files. Commit 9eb6b66. 2026-10-15.

What the scanners found

Committed secrets on production paths: 0
Vulnerable runtime dependencies: 2

@modelcontextprotocol/sdk (GHSA-6qxp-vccf-f47h), proxy-addr (GHSA-jqcg-44mw-7w3h)

Run it yourself

Scan any public repository in seconds — no sign-in, no card. Audit it to have a model read the code. Loop the report into your assistant to get the fixes applied and re-checked.

Scan your own repo

Questions

What did nittim read in alibaba/page-agent?: nittim read 233 of 233 eligible files in alibaba/page-agent. The reading ran on October 15, 2026. It was taken at commit 9eb6b66.
Did nittim find committed secrets or vulnerable dependencies in alibaba/page-agent?: The rule-based scan found 0 committed secrets and 2 vulnerable dependencies in alibaba/page-agent. Affected: @modelcontextprotocol/sdk (GHSA-6qxp-vccf-f47h), proxy-addr (GHSA-jqcg-44mw-7w3h).
Is alibaba/page-agent production ready?: A free scan is not a verdict. A full audit gives one.

Is alibaba/page-agent production ready?

What was read — rule-based scan

What the scanners found

Run it yourself

Questions

More like this