
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
A fully type-safe TypeScript client for Chrome DevTools Protocol, ported from the Python CDP-Use library.
any types, full TypeScript compilationDOM.NodeId, Runtime.ScriptIdnpm install cdp-use
import { CDPClient } from 'cdp-use';
async function example() {
const client = new CDPClient('ws://localhost:9222/devtools/browser/...');
await client.connect();
// Type-safe commands - full autocomplete and type checking!
const targets = await client.send.Target.getTargets();
const page = await client.send.Page.navigate({
url: 'https://example.com'
});
// Type-safe event registration
client.register.Page.onloadEventFired((event) => {
console.log('Page loaded at:', event.timestamp);
});
// Enable domains
await client.send.Page.enable();
await client.send.Runtime.enable();
await client.disconnect();
}
This library auto-generates from Chrome DevTools Protocol specifications:
DOM.NodeId, Runtime.RemoteObjectId, etc.See the examples/ folder for complete working examples:
demo.ts - Type safety showcase (no Chrome needed)simple.ts - Basic CDP operations and DOM accessbasic.ts - Event handling and session management# Type safety demo (no Chrome required)
npm run example:demo
# Real CDP examples (requires Chrome with --remote-debugging-port=9222)
npm run example:simple
npm run example:basic
Start Chrome with remote debugging:
chrome --remote-debugging-port=9222 --no-first-run --no-default-browser-check
Build the library:
npm install
npm run generate # Downloads latest CDP specs and generates types
npm run build # Compiles TypeScript
The CDP types are auto-generated from Chrome DevTools Protocol specifications:
# Using task (recommended)
task generate
# Or directly with npm
npm run generate
This downloads the latest protocol definitions and regenerates all TypeScript interfaces.
By default, the generator downloads the latest CDP specification from the master branch. To pin a specific version, edit src/generator/constants.ts:
// Pin to a specific commit
export const CDP_VERSION = "4b0c3f2e8c5d6a7b9e1f2a3c4d5e6f7a8b9c0d1e";
// Or use master for latest
export const CDP_VERSION = "refs/heads/master";
To find specific commits, visit: https://github.com/ChromeDevTools/devtools-protocol/commits/master
You can add custom CDP domains by placing JSON protocol files in src/custom_protocols/. The generator will automatically include them during type generation.
Example custom protocol (src/custom_protocols/browseruse.json):
{
"domains": [
{
"domain": "BrowserUse",
"description": "Custom domain for BrowserUse events",
"events": [
{
"name": "activeTargetChanged",
"description": "Fired when a target is activated",
"parameters": [
{ "name": "targetId", "$ref": "Target.TargetID" }
]
}
]
}
]
}
After adding custom protocols, regenerate types with task generate.
task generate # Regenerate CDP types from protocol definitions
task build # Build the TypeScript distribution
task dev # Start TypeScript compiler in watch mode
task clean # Clean build artifacts
task format # Format TypeScript code with prettier
task format-json # Format JSON protocol files
task example # Run the demo example
task example:simple # Run the simple example
task test # Run tests
task install # Install dependencies
// ✅ Correct - TypeScript enforces required parameters
await client.send.Page.navigate({ url: 'https://example.com' });
// ❌ Error - TypeScript catches missing required parameters
await client.send.Page.navigate(); // Error: url parameter required
const targets = await client.send.Target.getTargets();
// targets.targetInfos is fully typed with autocomplete
const firstTarget = targets.targetInfos[0];
console.log(firstTarget.targetId); // String type, autocomplete available
client.register.Runtime.onconsoleAPICalled((event) => {
// event parameter is fully typed
console.log(event.type); // "log" | "warn" | "error" | etc.
console.log(event.args); // Runtime.RemoteObject[]
console.log(event.timestamp); // number
});
// Types properly reference across domains
const nodeId: DOM.NodeId = await client.send.DOM.querySelector({
selector: 'body'
});
const remoteObject: Runtime.RemoteObject = await client.send.Runtime.evaluate({
expression: 'document.body'
});
class CDPClient {
constructor(url: string)
async connect(): Promise<void>
async disconnect(): Promise<void>
// Type-safe command sending
send: {
Target: TargetClient,
Page: PageClient,
Runtime: RuntimeClient,
DOM: DOMClient,
// ... all 53+ domains
}
// Type-safe event registration
register: {
Target: TargetClient,
Page: PageClient,
Runtime: RuntimeClient,
DOM: DOMClient,
// ... all 53+ domains
}
}
Each domain provides type-safe methods:
class PageClient {
// Commands
async enable(params?: PageCommands.enableParameters): Promise<{}>
async navigate(params: PageCommands.navigateParameters): Promise<PageCommands.navigateReturns>
async reload(params?: PageCommands.reloadParameters): Promise<{}>
// Event registration
ondomContentEventFired(handler: (event: PageEvents.domContentEventFiredEvent) => void): void
onloadEventFired(handler: (event: PageEvents.loadEventFiredEvent) => void): void
// ... more events
}
| Feature | Python CDP-Use | TypeScript CDP-Use |
|---|---|---|
| Type Safety | Runtime (Pydantic) | Compile-time (TypeScript) |
| IDE Support | Basic | Full IntelliSense |
| API Pattern | cdp.send.Domain.method() | client.send.Domain.method() |
| Event Registration | cdp.register.Domain.event() | client.register.Domain.onevent() |
| Error Checking | Runtime | Compile-time + Runtime |
| Auto-completion | Limited | Complete |
src/generator/npm run generate to regenerate CDP typesnpm run build and examplesMIT License - see LICENSE file for details.
FAQs
Type-safe TypeScript client for Chrome DevTools Protocol
The npm package cdp-use receives a total of 11 weekly downloads. As such, cdp-use popularity was classified as not popular.
We found that cdp-use demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.