HTTP library
node-fetch
Programming language clients. A script somebody wrote, purpose unknown.
Last updated
At a glance
| Category | HTTP library |
|---|---|
| User agent match | contains "node-fetch" |
| Executes JavaScript | No |
| Respects robots.txt | No |
| Identity verifiable | No, the name is only a claim |
| IVT class | GIVT (general invalid traffic: declared automation) |
What node-fetch is
node-fetch is not a company or a crawler, it is an HTTP client library: a building block programmers use to fetch pages from scripts. A visit carrying this name means someone wrote code that requested your page and did not bother to disguise it. The purpose can be anything from a harmless integration to a scraper.
Can the name be trusted?
There is no published way to verify node-fetch: the operator provides no IP ranges and no reverse DNS scheme, so the name in the user agent is only a claim. Any script can send it. TrueVisit still names the traffic, and weighs the claim against behavioral signals instead of trusting it.
Should you block it?
A content site rarely loses anything by challenging node-fetch. Legitimate integrations that use it (your own scripts, a partner feed) are known to you and can be allowed by address; everything else is unattended automation that ignores robots.txt. Prefer a challenge over a hard block so a misidentified client gets a way through.
For enforcement rather than a polite request, the Cloudflare blocking guide generates copy-paste WAF rules from this same signature list, with guardrails that keep verified search engines safe.
How TrueVisit reports it
Visits from node-fetch appear in your bot report under this exact name, never as an anonymous percentage, and every verdict stores the reason it was reached. Because this client never executes JavaScript, a browser-only tracker cannot see it at all; it is visible through server-side collection, which is how the visits reach your report.