{"schemaVersion":1,"status":{"id":"24a36e0e-7d8b-4c67-b316-3e6014571bbd","scanId":"d699dc14-dfb4-439a-a183-d763ca369042","invalidatedAt":null,"invalidationReason":null,"replacedBy":null,"snapshotAvailable":true,"policyAllowed":true,"createdAt":"2026-10-09T10:14:04.964Z","observationRevision":0,"previousScanId":null,"previousReportId":null,"current":true},"report":{"schemaVersion":1,"id":"24a36e0e-7d8b-4c67-b316-3e6014571bbd","scanId":"d699dc14-dfb4-439a-a183-d763ca369042","classifierRevision":"classifier_v2","observedAt":"2026-10-09T10:14:02.524Z","classifiedAt":"2026-10-09T10:14:04.967Z","artifact":{"name":"commander","version":"15.0.0","integrity":"sha512-z67u4ZhzCL/Tydu1lJARtEZYWbWaN7oYLHbsuzocr6y4N6WZAagG3RQ4FW61V1/0+jImpj293XfrcYnd1qxtPg==","tarballUrl":"https://registry.npmjs.org/commander/-/commander-15.0.0.tgz"},"preparation":{"id":"e874ff2e-acbe-4785-8172-ae61965cc51a","outcome":"pass","failure":null,"profileRevision":"npm_11_19_0_linux_amd64_v2","snapshot":{"id":"a56ced78-434b-4bbe-9497-5b2baa2d021f","generation":"8c7a29a0-36e0-482c-90e5-12c321839c01","lockDigest":"3d83304f77833f9b380cdca564990fcb7ee65de3cdaaddeb8b0efe8533c6071f","treeDigest":"18a4eb309a35d63e3dcfd7f36b0d5039c6f33ee85df20aaebb451363355d917b","profileRevision":"npm_11_19_0_linux_amd64_v2","installerImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7"},"installedCount":1,"omittedOptionalCount":0,"staticObservations":{"native":{"count":0,"paths":[],"buildIndicators":[],"prerequisiteProven":false},"declared":{"main":"./index.js","type":"module","engines":{"node":">=22.12.0"},"exports":{".":{"types":"./typings/index.d.ts","default":"./index.js"}},"scripts":{"fix":"npm run fix:lint && npm run fix:format","test":"node --test && npm run check:type:ts","check":"npm run check:type && npm run check:lint && npm run check:format","fix:lint":"eslint --fix .","test-all":"node --test && npm run check","check:lint":"eslint .","check:type":"npm run check:type:js && npm run check:type:ts","fix:format":"prettier --write .","check:format":"prettier --check .","check:type:js":"tsc -p tsconfig.js.json","check:type:ts":"tsd && tsc -p tsconfig.ts.json"},"devDependencies":{"tsd":"^0.33.0","eslint":"^10.0.2","globals":"^17.3.0","prettier":"^3.2.5","@eslint/js":"^10.0.1","typescript":"^6.0.2","@types/node":"^22.7.4","typescript-eslint":"^8.12.2","eslint-config-prettier":"^10.0.1"}},"platform":{"os":true,"cpu":true,"libc":true},"evidenceLevel":"static_only","lifecycleScripts":[]}},"matrix":{"id":"4dc87b12-9092-4ebf-a963-709a77c15297","revision":"production_ce416e976d3b4c51b252859d31c1fa7c","platform":"linux_amd64_glibc","harnessRevision":"load_v2","planRevision":"explicit_exports_v1","policyRevision":"runtime_limits_v2","images":[{"profileId":"node_24_21_0","kind":"node","version":"24.21.0","imageId":"sha256:e3a5a41a242a766e69f326b91f9ed9280c5719ad3e9ab54f0ac28bfc71d77794","builtAt":"2026-10-04T15:20:38.392Z","sourceImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"node_26_10_0","kind":"node","version":"26.10.0","imageId":"sha256:5d2fa297021c7db25494856bb25e2cddecbb020722ce1e0f2101385a063c0611","builtAt":"2026-10-04T15:20:47.161Z","sourceImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"bun_1_4_2","kind":"bun","version":"1.4.2","imageId":"sha256:fd67412f5baad0c2b1038367df9cf2d4b33237d3815e16eedae16cfd94ab3182","builtAt":"2026-10-04T15:21:07.160Z","sourceImage":"oven/bun:1.4.2-debian@sha256:53710ce0f14eef8312521c586a7ae1d9aeab4011840f09f1966073b68fc2e2ab","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"deno_2_9_7","kind":"deno","version":"2.9.7","imageId":"sha256:3b0f993e5ec0b1d4e8e09bc50ae53f142f7347d0baf96cefe7a8cfe7a00f7958","builtAt":"2026-10-04T15:21:22.570Z","sourceImage":"denoland/deno:debian-2.9.7@sha256:869d374bdaddda4fde029c492d7219199b0e821c2c53cca5357b3a6f5b9336fc","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"}]},"omissions":{"counts":{"pattern":0,"non_executable":0,"not_exported":0,"invalid_subpath":0,"coverage_limit":0},"samples":[]},"outcome":"pass","evidenceLevel":"smoke_tested","coverageComplete":true,"cells":[{"runId":"11d36eed-b77e-4bb0-9657-926d123217e4","profileId":"node_24_21_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":336.0920080000069,"failure":null,"entries":[{"index":0,"specifier":"commander","displaySpecifier":"commander","outcome":"pass","durationMs":9.546311999999997,"resolvedTo":"file:///workspace/node_modules/commander/index.js","failure":null}],"sessions":[{"probeId":"7f7dfa7a-c501-4e08-892f-973ed594faf4","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":336.0920080000069}]},{"runId":"acf21db8-6067-4751-891b-b574d3307db8","profileId":"node_24_21_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":324.6163129999768,"failure":null,"entries":[{"index":0,"specifier":"commander","displaySpecifier":"commander","outcome":"pass","durationMs":10.929064,"resolvedTo":"/workspace/node_modules/commander/index.js","failure":null}],"sessions":[{"probeId":"14ace277-0ed2-4c3b-a471-791f99e68fd4","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":324.6163129999768}]},{"runId":"d5899055-471a-4027-9abc-3e033e06a4df","profileId":"node_24_21_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"cc94fdd5-07e2-45cb-b353-4f44d154ccaa","profileId":"node_24_21_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"981280ef-94b5-4cb7-bcba-386d253687ba","profileId":"node_26_10_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":345.7155770000536,"failure":null,"entries":[{"index":0,"specifier":"commander","displaySpecifier":"commander","outcome":"pass","durationMs":12.123185999999997,"resolvedTo":"file:///workspace/node_modules/commander/index.js","failure":null}],"sessions":[{"probeId":"b2ca2f6a-7ddd-4c1d-abe8-dc826f38b603","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":345.7155770000536}]},{"runId":"09d84234-da28-4a2a-8ece-77f28becc82f","profileId":"node_26_10_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":329.7004130000714,"failure":null,"entries":[{"index":0,"specifier":"commander","displaySpecifier":"commander","outcome":"pass","durationMs":16.478926,"resolvedTo":"/workspace/node_modules/commander/index.js","failure":null}],"sessions":[{"probeId":"c73d96c6-9290-4e12-9458-a22093782474","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":329.7004130000714}]},{"runId":"20dc5ad7-461f-46a4-be68-7253b6213bed","profileId":"node_26_10_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"f52ff853-1b0d-47aa-9baf-79d22642b5c0","profileId":"node_26_10_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"1cd2e5f0-56c0-49b7-9a5a-c1f415e9387d","profileId":"bun_1_4_2","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":314.8955269999569,"failure":null,"entries":[{"index":0,"specifier":"commander","displaySpecifier":"commander","outcome":"pass","durationMs":9.478986,"resolvedTo":"file:///workspace/node_modules/commander/index.js","failure":null}],"sessions":[{"probeId":"883e51ff-7851-4b84-93d0-eff78fedc493","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":314.8955269999569}]},{"runId":"5708d287-ebad-4758-be9b-6398103d153e","profileId":"bun_1_4_2","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":383.40898800001014,"failure":null,"entries":[{"index":0,"specifier":"commander","displaySpecifier":"commander","outcome":"pass","durationMs":8.619634,"resolvedTo":"/workspace/node_modules/commander/index.js","failure":null}],"sessions":[{"probeId":"533ae13b-3bb8-4baa-bf3e-8c2c5e7f38e8","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":383.40898800001014}]},{"runId":"287de3dc-1361-4c73-92ae-571be496b456","profileId":"bun_1_4_2","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"75283849-04d4-4365-80fd-898299483d96","profileId":"bun_1_4_2","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"88d73f45-84b8-4ba3-b66f-42a149c162bd","profileId":"deno_2_9_7","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":456.3762219999917,"failure":null,"entries":[{"index":0,"specifier":"commander","displaySpecifier":"commander","outcome":"pass","durationMs":6.676653000000002,"resolvedTo":"file:///workspace/node_modules/commander/index.js","failure":null}],"sessions":[{"probeId":"0866a236-adae-4cfa-b8eb-7479a96f6a9a","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":456.3762219999917}]},{"runId":"8d215f5b-80f6-4329-8d29-be6a999eb5d8","profileId":"deno_2_9_7","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":425.0964639999438,"failure":null,"entries":[{"index":0,"specifier":"commander","displaySpecifier":"commander","outcome":"pass","durationMs":46.041511,"resolvedTo":"/workspace/node_modules/commander/index.js","failure":null}],"sessions":[{"probeId":"bc7bd674-34d7-4620-9ea1-178b9e5b482f","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":425.0964639999438}]},{"runId":"86e542a5-8ae2-472d-8b8f-471d6c00b1c4","profileId":"deno_2_9_7","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"d9805907-d9c5-47b4-8864-551abfd47833","profileId":"deno_2_9_7","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]}],"limitations":["Only installation and loading were observed; functional correctness and package safety are not established.","Subpath batches share module caches and globals; root modes use separate fresh sandboxes.","Package-visible harness observations can be tampered with. They are not adversarial attestation.","Evidence applies to these exact artifacts, dependency snapshot, runtime images and Linux amd64/glibc policy.","Runtime error codes are captured observations and can also be thrown by package code."]}}