{"schemaVersion":1,"status":{"id":"5eb4e36f-ea6b-4dcb-9fcf-34ac0655a98c","scanId":"92321333-1c02-4a70-b0bc-47eed57d591d","invalidatedAt":null,"invalidationReason":null,"replacedBy":"70e276ef-4b62-4381-9a18-522752d8940d","snapshotAvailable":true,"policyAllowed":true,"createdAt":"2026-10-05T06:03:32.264Z","observationRevision":0,"previousScanId":null,"previousReportId":null,"current":false},"report":{"schemaVersion":1,"id":"5eb4e36f-ea6b-4dcb-9fcf-34ac0655a98c","scanId":"92321333-1c02-4a70-b0bc-47eed57d591d","classifierRevision":"classifier_v1","observedAt":"2026-10-05T06:03:31.293Z","classifiedAt":"2026-10-05T06:03:32.267Z","artifact":{"name":"lodash","version":"4.18.1","integrity":"sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==","tarballUrl":"https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz"},"preparation":{"id":"1b1a563b-2e53-433d-a09e-27060bea898b","outcome":"pass","failure":null,"profileRevision":"npm_11_19_0_linux_amd64_v2","snapshot":{"id":"7daca743-57e2-4da0-90d1-d2253d10025c","generation":"c54c4ab9-f794-4bf5-8e71-d059cc6ceaab","lockDigest":"83fef5fcee40d4d3cf5f87faf3e6186bd458a3426e13daf128676747b5fcb198","treeDigest":"29b6528827272276b455e671eae28ffc20c8a19344cade66f09d678344a70b57","profileRevision":"npm_11_19_0_linux_amd64_v2","installerImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7"},"installedCount":1,"omittedOptionalCount":0,"staticObservations":{"native":{"count":0,"paths":[],"buildIndicators":[],"prerequisiteProven":false},"declared":{"main":"lodash.js","scripts":{"test":"echo \"See https://travis-ci.org/lodash-archive/lodash-cli for testing details.\""}},"platform":{"os":true,"cpu":true,"libc":true},"evidenceLevel":"static_only","lifecycleScripts":[]}},"matrix":{"id":"c18bed16-c2f6-4100-94c2-9117ac7bc2e5","revision":"production_f10071512e0e7e24c6867f11e90a7da0","platform":"linux_amd64_glibc","harnessRevision":"load_v2","planRevision":"explicit_exports_v1","policyRevision":"runtime_limits_v2","images":[{"profileId":"node_24_21_0","kind":"node","version":"24.21.0","imageId":"sha256:cb6150e21f96e0cced8169843922f9f0363d32d3be86393172958aeb9d653aac","builtAt":"2026-10-04T15:20:38.392Z","sourceImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"node_26_10_0","kind":"node","version":"26.10.0","imageId":"sha256:348bbebdc16cde773af001ccf9734936485091fadf0b6162224c796fbf343a81","builtAt":"2026-10-04T15:20:47.161Z","sourceImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"bun_1_4_2","kind":"bun","version":"1.4.2","imageId":"sha256:58846b11e3e63c83dd1bbfa12097e641025bd57febe737c2bfaf2962a63fbacb","builtAt":"2026-10-04T15:21:07.160Z","sourceImage":"oven/bun:1.4.2-debian@sha256:53710ce0f14eef8312521c586a7ae1d9aeab4011840f09f1966073b68fc2e2ab","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"deno_2_9_7","kind":"deno","version":"2.9.7","imageId":"sha256:d2ee9affe35ff6eb8d788fcdc202e2e74802a2936e9acdfc63cd6b7d2aea0777","builtAt":"2026-10-04T15:21:22.570Z","sourceImage":"denoland/deno:debian-2.9.7@sha256:869d374bdaddda4fde029c492d7219199b0e821c2c53cca5357b3a6f5b9336fc","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"}]},"omissions":{"counts":{"pattern":0,"non_executable":0,"not_exported":0,"invalid_subpath":0,"coverage_limit":0},"samples":[]},"outcome":"pass","evidenceLevel":"smoke_tested","coverageComplete":true,"cells":[{"runId":"28e3165c-36cc-4c09-9a12-5dfe98394196","profileId":"node_24_21_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":316.49262800067663,"failure":null,"entries":[{"index":0,"specifier":"lodash","displaySpecifier":"lodash","outcome":"pass","durationMs":23.882290999999995,"resolvedTo":"file:///workspace/node_modules/lodash/lodash.js","failure":null}],"sessions":[{"probeId":"8d866951-538e-44f4-bfe0-4d542ba6c3ac","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":316.49262800067663}]},{"runId":"c399c34f-8eff-4ef4-a3c3-84bc854fe807","profileId":"node_24_21_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":423.2812220007181,"failure":null,"entries":[{"index":0,"specifier":"lodash","displaySpecifier":"lodash","outcome":"pass","durationMs":13.832936000000004,"resolvedTo":"/workspace/node_modules/lodash/lodash.js","failure":null}],"sessions":[{"probeId":"203bcc0d-5b00-4995-a035-a7cce2eb9265","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":423.2812220007181}]},{"runId":"ffdf550b-f91a-4607-9d90-ef4907e6478f","profileId":"node_24_21_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"1ed0b4b8-0021-47e2-a477-e60955ca38a7","profileId":"node_24_21_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"f211d1ac-0c67-41c6-9149-275500bac544","profileId":"node_26_10_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":435.3494810014963,"failure":null,"entries":[{"index":0,"specifier":"lodash","displaySpecifier":"lodash","outcome":"pass","durationMs":20.137209,"resolvedTo":"file:///workspace/node_modules/lodash/lodash.js","failure":null}],"sessions":[{"probeId":"3a82b937-514e-41a8-910b-2d6672b8fee5","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":435.3494810014963}]},{"runId":"18b02df2-b3d7-4065-ae17-f33b40a0ce82","profileId":"node_26_10_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":322.9729319997132,"failure":null,"entries":[{"index":0,"specifier":"lodash","displaySpecifier":"lodash","outcome":"pass","durationMs":16.944219000000004,"resolvedTo":"/workspace/node_modules/lodash/lodash.js","failure":null}],"sessions":[{"probeId":"499024d5-c921-4c66-9874-83c113f7fc31","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":322.9729319997132}]},{"runId":"0fc84710-0e5b-4e24-a02e-e5aa13b5d59a","profileId":"node_26_10_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"fafe13b6-a1e3-498f-8879-13985abbcd7f","profileId":"node_26_10_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"222b1cf6-222d-4e25-8f48-d8279d95f12c","profileId":"bun_1_4_2","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":316.83630600199103,"failure":null,"entries":[{"index":0,"specifier":"lodash","displaySpecifier":"lodash","outcome":"pass","durationMs":28.324996000000002,"resolvedTo":"file:///workspace/node_modules/lodash/lodash.js","failure":null}],"sessions":[{"probeId":"74df19d7-1dc3-4e66-b4d1-c1588b7ac7c7","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":316.83630600199103}]},{"runId":"ce34fcaf-f186-4bfe-9607-f584698d490f","profileId":"bun_1_4_2","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":333.4672209993005,"failure":null,"entries":[{"index":0,"specifier":"lodash","displaySpecifier":"lodash","outcome":"pass","durationMs":19.591639,"resolvedTo":"/workspace/node_modules/lodash/lodash.js","failure":null}],"sessions":[{"probeId":"344b5752-bf70-438e-bed4-3a61b6836c57","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":333.4672209993005}]},{"runId":"13c50310-ec59-44e8-8fb6-0289102647f3","profileId":"bun_1_4_2","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"5904fcef-51ec-4c48-bcd7-6e8292c4ce47","profileId":"bun_1_4_2","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"20dbe64e-23e9-45b9-8e66-4d46edb64e6b","profileId":"deno_2_9_7","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":561.5164089985192,"failure":null,"entries":[{"index":0,"specifier":"lodash","displaySpecifier":"lodash","outcome":"pass","durationMs":149.331507,"resolvedTo":"file:///workspace/node_modules/lodash/lodash.js","failure":null}],"sessions":[{"probeId":"554b7cd9-a33b-4f66-a464-f6acff948122","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":561.5164089985192}]},{"runId":"abe7301b-fbe6-448d-9267-8108fdf7814e","profileId":"deno_2_9_7","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":437.4351189993322,"failure":null,"entries":[{"index":0,"specifier":"lodash","displaySpecifier":"lodash","outcome":"pass","durationMs":17.68711300000001,"resolvedTo":"/workspace/node_modules/lodash/lodash.js","failure":null}],"sessions":[{"probeId":"f2410a73-1d6d-4aa2-8a17-a00b51e033c1","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":437.4351189993322}]},{"runId":"7174836f-d00f-4099-a655-ff8550fb40b4","profileId":"deno_2_9_7","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"0f032ec6-44fe-48d2-9234-430ce95d6d65","profileId":"deno_2_9_7","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]}],"limitations":["Only installation and loading were observed; functional correctness and package safety are not established.","Subpath batches share module caches and globals; root modes use separate fresh sandboxes.","Package-visible harness observations can be tampered with. They are not adversarial attestation.","Evidence applies to these exact artifacts, dependency snapshot, runtime images and Linux amd64/glibc policy.","Runtime error codes are captured observations and can also be thrown by package code."]}}