
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Create, run, and heal AI-assisted Playwright flows with a single dependency. The donobu package ships the Playwright fixture, Page.AI orchestration layer, CLI wrapper, failure triage, and plugin system to comprehensively test websites.
import { test } from 'donobu' to extend Playwright with page.ai helpers, smart selectors, and persistence.page.ai() with optional Zod schemas, cached tool-call replays, custom tool allow-lists, and env-var controls.page.runAccessibilityTest, etc).npx donobu test --auto-heal captures screenshots, GPT reasoning, structured treatment plans, and can re-run fixes automatically.npx playwright install).npm install --save-dev donobu @playwright/test
npx playwright install # downloads browsers if needed
import { test } from 'donobu';
test('Test for https://www.starbucks.com', async ({ page }) => {
await page.goto('https://www.starbucks.com');
await page.ai('Go to the featured menu page');
await page.ai.assert(
`Assert that the featured menu page has a seasonally appropriate vibe for ${new Date()}`,
);
await page.ai('Find a Starbucks store in Stowe, Vermont');
await page.ai.assert(
'Assert that a store in Stowe, Vermont is found and the map shows Mt. Mansfield close by.',
);
});
OPENAI_API_KEY=sk-*** npx donobu test
npx donobu test proxies Playwright while wiring Donobu-specific env vars (triage directories, Page.AI cache clearing, auto-heal retries, etc.).
| Method | Description |
|---|---|
await page.ai(instruction, opts?) | Launches an autonomous Donobu flow that can call browser tools. |
await page.ai.assert(assertion, opts?) | AI assertion against DOM text, screenshot, title, and URL. |
await page.ai.extract(schema, opts?) | Produce JSON data shaped by a Zod schema using screenshot + history. |
page.ai() is cached in <spec directory>/.cache-lock/<spec-file>.cache.js. Run npx donobu test --clear-ai-cache to regenerate the cache..cache-lock/<spec-file>.cache.js. Commit them to stabilise selectors or delete to regenerate.--clear-ai-cache (or DONOBU_PAGE_AI_CLEAR_CACHE=1) clears cache before each page.ai.act.page.ai() instruction or by passing them as options:
test('uses secret', async ({ page }, testInfo) => {
await page.ai('Log in using {{$.env.MY_SECRET}} credentials', {
envVars: ['SOME_OTHER_SECRET'],
});
});
In the above example, the page.ai agent will have access to the MY_SECRET and SOME_OTHER_SECRET env vars.npx donobu mirrors Playwright subcommands and adds Donobu-specific tooling.
| Command | What it does |
|---|---|
npx donobu test [playwright args] | Runs Playwright tests with Donobu fixtures, triage, optional auto-heal, and Page.AI caching controls. |
npx donobu test --auto-heal | After failures, generate treatment plans and automatically retry tests whose plans recommend it. |
npx donobu test --no-triage | Skip evidence gathering (faster but no treatment plans). |
npx donobu test --triage-output-dir ./artifacts | Persist evidence outside test-results/donobu-triage. |
npx donobu test --clear-ai-cache | Clear Page.AI cache before every act() invocation for the run. |
npx donobu heal --plan path/to/plan.json | Re-run a previously generated treatment plan with matching Playwright args. |
npx playwright-json-to-markdown report.json | Convert Playwright JSON reports into human-friendly Markdown. |
npx playwright-json-to-slack-json report.json | Produce Slack-ready payloads from Playwright reports. |
donobu test, failure evidence (flow metadata, screenshots, DOM dumps, GPT summaries) is stored under test-results/donobu-triage/<timestamp>-<runId>/.triageTestFailure builds a structured treatment plan containing failure reason, remediation steps, and automation directives. Plans are written next to the evidence (prefixed with treatment-plan-).--auto-heal lets Donobu run an autonomous flow that attempts to fix selectors/code. Successful fixes attach regenerated tests (fixed-test.ts) and annotate runs with @self-healed.Donobu selects a GPT backend in the following priority order:
BASE64_GPT_CONFIG - Base64 JSON matching GptConfigSchema.DONOBU_API_KEY - use Donobu hosted models.AWS_BEDROCK_MODEL_NAME, AWS_REGION, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY).ANTHROPIC_API_KEY, optional ANTHROPIC_MODEL_NAME).GOOGLE_GENERATIVE_AI_API_KEY, optional GOOGLE_GENERATIVE_AI_MODEL_NAME).OPENAI_API_KEY, optional OPENAI_API_MODEL_NAME).Additional runtime env vars:
| Env var | Purpose |
|---|---|
DONOBU_PAGE_AI_CLEAR_CACHE | Force cache invalidation for every page.ai() call. |
BASE_WORKING_DIR | Override the platform-specific Donobu data directory. |
BROWSERBASE_API_KEY / BROWSERBASE_PROJECT_ID | Run flows inside BrowserBase sessions instead of local Chromium. |
FAQs
Create browser automations with an LLM agent and replay them as Playwright scripts.
The npm package donobu receives a total of 2,797 weekly downloads. As such, donobu popularity was classified as popular.
We found that donobu demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.