
Security News
Rust RFC Proposes a Security Tab on crates.io for RustSec Advisories
Rust’s crates.io team is advancing an RFC to add a Security tab that surfaces RustSec vulnerability and unsoundness advisories directly on crate pages.
@browserbasehq/stagehand
Advanced tools
Affected versions:
An AI web browsing framework focused on simplicity and extensibility.
The AI Browser Automation Framework
Read the Docs
If you're looking for the Python implementation, you can find it here
Stagehand is a browser automation framework used to control web browsers with natural language and code. By combining the power of AI with the precision of code, Stagehand makes web automation flexible, maintainable, and actually reliable.
Most existing browser automation tools either require you to write low-level code in a framework like Selenium, Playwright, or Puppeteer, or use high-level agents that can be unpredictable in production. By letting developers choose what to write in code vs. natural language (and bridging the gap between the two) Stagehand is the natural choice for browser automations in production.
Choose when to write code vs. natural language: use AI when you want to navigate unfamiliar pages, and use code when you know exactly what you want to do.
Go from AI-driven to repeatable workflows: Stagehand lets you preview AI actions before running them, and also helps you easily cache repeatable actions to save time and tokens.
Write once, run forever: Stagehand's auto-caching combined with self-healing remembers previous actions, runs without LLM inference, and knows when to involve AI whenever the website changes and your automation breaks.
Start with Stagehand with one line of code, or check out our Quickstart Guide for more information:
npx create-browser-app
Here's how to build a sample browser automation with Stagehand:
// Stagehand's CDP engine provides an optimized, low level interface to the browser built for automation
const page = stagehand.context.pages()[0];
await page.goto("https://github.com/browserbase");
// Use act() to execute individual actions
await stagehand.act("click on the stagehand repo");
// Use agent() for multi-step tasks
const agent = stagehand.agent();
await agent.execute("Get to the latest PR");
// Use extract() to get structured data from the page
const { author, title } = await stagehand.extract(
"extract the author and title of the PR",
z.object({
author: z.string().describe("The username of the PR author"),
title: z.string().describe("The title of the PR"),
}),
);
Visit docs.stagehand.dev to view the full documentation.
git clone https://github.com/browserbase/stagehand.git
cd stagehand
pnpm install
pnpm run build
pnpm run example # run the blank script at ./examples/example.ts
Stagehand is best when you have an API key for an LLM provider and Browserbase credentials. To add these to your project, run:
cp .env.example .env
nano .env # Edit the .env file to add API keys
You can install and build Stagehand directly from a github branch using gitpkg
In your project's package.json set:
"@browserbasehq/stagehand": "https://gitpkg.now.sh/browserbase/stagehand/packages/core?<branchName>",
[!NOTE]
We highly value contributions to Stagehand! For questions or support, please join our Slack community.
At a high level, we're focused on improving reliability, extensibility, speed, and cost in that order of priority. If you're interested in contributing, bug fixes and small improvements are the best way to get started. For more involved features, we strongly recommend reaching out to Miguel Gonzalez or Paul Klein in our Slack community before starting to ensure that your contribution aligns with our goals.
We'd like to thank the following people for their major contributions to Stagehand:
Licensed under the MIT License.
Copyright 2025 Browserbase, Inc.
FAQs
An AI web browsing framework focused on simplicity and extensibility.
The npm package @browserbasehq/stagehand receives a total of 403,901 weekly downloads. As such, @browserbasehq/stagehand popularity was classified as popular.
We found that @browserbasehq/stagehand demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 11 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Rust’s crates.io team is advancing an RFC to add a Security tab that surfaces RustSec vulnerability and unsoundness advisories directly on crate pages.

Security News
/Research
Socket found a Rust typosquat (finch-rust) that loads sha-rust to steal credentials, using impersonation and an unpinned dependency to auto-deliver updates.

Research
/Security Fundamentals
A pair of typosquatted Go packages posing as Google’s UUID library quietly turn helper functions into encrypted exfiltration channels to a paste site, putting developer and CI data at risk.