puppeteer-extra-plugin-stealth in 2026: 238 issues, no commit

When a Puppeteer script meets a bot wall, the fix people reach for is two lines: puppeteer-extra and its stealth plugin. The plugin is still downloaded more than 800,000 times a week. We read its repository, its source and its issue tracker on 22 September 2026 to see what that answer is worth today, and compared it with the maintained tools that took its place.

What is puppeteer-extra-plugin-stealth?

puppeteer-extra-plugin-stealth is a plugin for puppeteer-extra that applies "various techniques to make detection of headless puppeteer harder". It works by injecting scripts into every page before the page's own code runs, and each script rewrites one value a detector might read. The package ships 17 of these evasions, among them navigator.webdriver, navigator.plugins, chrome.runtime, user-agent-override and webgl.vendor.

What state is the plugin in today?

The plugin has not changed since March 2023, while real Chrome on our test host had reached version 153 by 10 September 2026. We read the numbers from the GitHub API, GitHub's issue search and the npm registry on the same day.

The README states the limit itself: "It's probably impossible to prevent all ways to detect headless chromium, but it should be possible to make it so difficult that it becomes cost-prohibitive". That plan needs someone to keep raising the cost, and since 2023 nobody has.

Why can a plugin not hide the control plane?

A plugin that rewrites values from inside the page can only hide what the page reads through JavaScript, and it has to guess what a normal browser would answer. The webgl.vendor evasion shows both limits. Its source sets the vendor to "Intel Inc." and the renderer to "Intel Iris OpenGL Engine" by default, on every machine that installs it. A page that draws a WebGL scene and reads the pixels back gets the output of the real graphics card, or of the SwiftShader software renderer in a headless run, next to a string claiming an Intel GPU. A fleet of these browsers reports one and the same graphics card.

The other half is the protocol. Puppeteer drives Chrome over the Chrome DevTools Protocol, and everything the plugin changes arrives through that same connection. In Ian L. Paterson's benchmark of 7 tools against 31 targets, the disagreement between tools came mostly from automation-protocol fingerprinting: "Playwright forks fail regardless of patch quality, and defeating that layer takes a control plane that is not Playwright." The stealth plugin was not part of that test, so the table below carries no result for it.

Does playwright-stealth do better?

No, because it is a port of the same evasions to Playwright and inherits both limits. The Python playwright_stealth repository was last pushed on 29 July 2024. Paterson's benchmark measured vanilla Playwright at 24 of 31 targets and rebrowser-playwright at the same 24.

Which maintained tools replace it, and what do they change?

The tools that replaced the plugin change either the driver or the browser, instead of the page. We checked licence and last release on GitHub and took the results from Paterson's benchmark, which ran three sweeps from one residential IP address in May 2026.

The plugin changes values inside the page, nodriver and Patchright change the driver, and Camoufox changes the browser. nodriver calls itself "the official successor of the Undetected-Chromedriver python package" and starts a "fresh profile on each run". Patchright patches the Runtime.enable and Console.enable leaks and warns that "console functionality will not work in Patchright"; its patch list contains no fingerprint surface. Camoufox is a Firefox build, so it cannot present a Chrome identity where a site expects one.

So which should you pick?

Our verdict: do not start a new project on puppeteer-extra-plugin-stealth in 2026. It rewrites values from inside the page, it assumes one Intel GPU for every machine, and it has not been maintained since March 2023. If a script already depends on it, the migration guide for Playwright and Puppeteer shows how to attach the same code to a profile over CDP and drop the plugin.