
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@brightdata/sdk
Advanced tools
npm install @brightdata/sdk
import { bdclient } from '@brightdata/sdk';
const client = new bdclient({
apiKey: '[your_api_token]', // or set BRIGHTDATA_API_TOKEN env variable
});
// Scrape a webpage
const html = await client.scrapeUrl('https://example.com');
console.log(html);
// Search the web
const results = await client.search.google('pizza restaurants');
console.log(results);
Don't forget to close when done:
await client.close();
@brightdata/sdk/scrapers, @brightdata/sdk/search, @brightdata/sdk/datasets// Single URL — returns HTML string by default
const html = await client.scrapeUrl('https://example.com');
// Multiple URLs (parallel processing)
const results = await client.scrapeUrl([
'https://example1.com',
'https://example2.com',
]);
// Get markdown content
const md = await client.scrapeUrl('https://example.com', {
dataFormat: 'markdown',
});
// Get structured JSON
const data = await client.scrapeUrl('https://example.com', {
format: 'json',
});
// Take a screenshot
const screenshot = await client.scrapeUrl('https://example.com', {
dataFormat: 'screenshot',
});
// Full options
const result = await client.scrapeUrl('https://example.com', {
format: 'raw', // 'raw' (default) or 'json'
dataFormat: 'html', // 'html' (default), 'markdown', 'screenshot'
country: 'gb', // two-letter country code
method: 'GET', // HTTP method
});
// Google search
const results = await client.search.google('pizza restaurants');
// Bing search
const results = await client.search.bing('pizza restaurants');
// Yandex search
const results = await client.search.yandex('pizza restaurants');
// Batch search (parallel)
const results = await client.search.google(['pizza', 'sushi', 'tacos']);
// With options
const results = await client.search.google('pizza', {
country: 'gb',
format: 'json',
});
Collect structured data from popular platforms. Each platform supports sync collection (collect*) and async orchestrated scraping (trigger, poll, download).
// LinkedIn profiles
const data = await client.scrape.linkedin.collectProfiles(
['https://www.linkedin.com/in/satyanadella/'],
{ format: 'json' },
);
// Amazon products
const data = await client.scrape.amazon.collectProducts(
['https://www.amazon.com/dp/B0D77BX8Y4'],
{ format: 'json' },
);
// Instagram profiles
const data = await client.scrape.instagram.collectProfiles(
['https://www.instagram.com/natgeo/'],
{ format: 'json' },
);
// TikTok profiles
const data = await client.scrape.tiktok.collectProfiles(
['https://www.tiktok.com/@tiktok'],
{ format: 'json' },
);
// YouTube videos
const data = await client.scrape.youtube.collectVideos(
['https://www.youtube.com/watch?v=dQw4w9WgXcQ'],
{ format: 'json' },
);
// Reddit posts
const data = await client.scrape.reddit.collectPosts(
['https://www.reddit.com/r/technology/top/'],
{ format: 'json' },
);
Orchestrated scraping (async trigger → poll → download):
const result = await client.scrape.linkedin.profiles(
['https://www.linkedin.com/in/satyanadella/'],
{ pollInterval: 5000, pollTimeout: 180_000 },
);
console.log(result.data); // structured data
console.log(result.status); // 'ready'
console.log(result.rowCount);
Available platforms: linkedin, amazon, instagram, tiktok, youtube, reddit, facebook, chatGPT, digikey, perplexity
Access pre-built datasets for querying and downloading structured data snapshots.
const ds = client.datasets;
// List all datasets available on your account
const list = await ds.list();
// Get field metadata for a dataset
const meta = await ds.instagramProfiles.getMetadata();
console.log(meta.fields); // [{ name, type, description }, ...]
// Query a dataset (triggers a snapshot)
const snapshotId = await ds.instagramProfiles.query(
{ url: 'https://www.instagram.com/natgeo/' },
{ records_limit: 10 },
);
// Check snapshot status
const status = await ds.instagramProfiles.getStatus(snapshotId);
console.log(status.status); // 'running' | 'ready' | ...
// Download when ready
const rows = await ds.instagramProfiles.download(snapshotId);
Available datasets:
| Platform | Datasets |
|---|---|
linkedinProfiles, linkedinCompanies | |
| Amazon | amazonProducts, amazonReviews, amazonSellers, amazonBestSellers, amazonProductsSearch, amazonProductsGlobal, amazonWalmart |
instagramProfiles, instagramPosts, instagramComments, instagramReels | |
| TikTok | tiktokProfiles, tiktokPosts, tiktokComments, tiktokShop |
| X/Twitter | xTwitterPosts, xTwitterProfiles |
const data = await client.scrapeUrl('https://example.com');
const filePath = await client.saveResults(data, {
filename: 'results.json',
format: 'json',
});
console.log(`Saved to: ${filePath}`);
Get your API token from Bright Data Control Panel.
BRIGHTDATA_API_TOKEN=your_api_token
BRIGHTDATA_WEB_UNLOCKER_ZONE=your_web_unlocker_zone # Optional
BRIGHTDATA_SERP_ZONE=your_serp_zone # Optional
BRIGHTDATA_VERBOSE=1 # Optional, enable verbose logging
const client = new bdclient({
apiKey: 'string', // API token (or use BRIGHTDATA_API_TOKEN env var)
timeout: 120000, // Request timeout in ms (1000–300000)
autoCreateZones: true, // Auto-create zones if they don't exist
webUnlockerZone: 'string', // Custom web unlocker zone name
serpZone: 'string', // Custom SERP zone name
logLevel: 'INFO', // 'DEBUG' | 'INFO' | 'WARNING' | 'ERROR' | 'CRITICAL'
structuredLogging: true, // Use structured JSON logging
verbose: false, // Enable verbose logging
rateLimit: 0, // Max requests per period (0 = unlimited)
ratePeriod: 1000, // Rate limit period in ms
});
The client maintains HTTP connections. Always close when done:
await client.close();
// Or use Symbol.asyncDispose (TypeScript 5.2+)
await using client = new bdclient();
| Constant | Default | Description |
|---|---|---|
DEFAULT_CONCURRENCY | 10 | Max parallel tasks |
DEFAULT_TIMEOUT | 120000 | Request timeout (milliseconds) |
MAX_RETRIES | 3 | Retry attempts on failure |
RETRY_BACKOFF_FACTOR | 1.5 | Exponential backoff multiplier |
const zones = await client.listZones();
console.log(`Found ${zones.length} zones`);
For tree-shaking or importing only what you need:
import { ScrapeRouter, LinkedinAPI } from '@brightdata/sdk/scrapers';
import { SearchRouter } from '@brightdata/sdk/search';
import { DatasetsClient, BaseDataset } from '@brightdata/sdk/datasets';
The SDK exports typed error classes that extend BRDError:
import { bdclient, ValidationError, AuthenticationError, BRDError } from '@brightdata/sdk';
try {
const result = await client.scrapeUrl('https://example.com');
} catch (error) {
if (error instanceof ValidationError) {
console.error('Invalid input:', error.message);
} else if (error instanceof AuthenticationError) {
console.error('Auth failed:', error.message);
} else if (error instanceof BRDError) {
console.error('SDK error:', error.message);
}
}
Error types: ValidationError, AuthenticationError, ZoneError, NetworkError, NetworkTimeoutError, TimeoutError, APIError, DataNotReadyError, FSError
git clone https://github.com/brightdata/bright-data-sdk-js.git
cd bright-data-sdk-js
npm install
npm run build:dev
We use Semantic Release for automated releases. Commit message conventions:
fix: — triggers a PATCH release (0.5.0 => 0.5.1)feat: — triggers a MINOR release (0.5.0 => 0.6.0)feat!: or BREAKING CHANGE: in footer — triggers a MAJOR release (0.5.0 => 1.0.0)docs: — documentation only, no releasechore: — general maintenance, no releaseFor any issues, contact Bright Data support, or open an issue in this repository.
This project is licensed under the MIT License.
FAQs
JavaScript SDK for Bright Data Web Scraping and SERP APIs
We found that @brightdata/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.