{"schemaVersion":1,"status":{"id":"7234276a-2334-4d04-bd3b-485919be3913","scanId":"d4f15073-d223-4737-b8a9-6d78ca5ef4e6","invalidatedAt":null,"invalidationReason":null,"replacedBy":null,"snapshotAvailable":true,"policyAllowed":true,"createdAt":"2026-10-09T11:13:56.589Z","observationRevision":0,"previousScanId":null,"previousReportId":null,"current":true},"report":{"schemaVersion":1,"id":"7234276a-2334-4d04-bd3b-485919be3913","scanId":"d4f15073-d223-4737-b8a9-6d78ca5ef4e6","classifierRevision":"classifier_v2","observedAt":"2026-10-09T11:13:53.980Z","classifiedAt":"2026-10-09T11:13:56.592Z","artifact":{"name":"ws","version":"8.22.0","integrity":"sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==","tarballUrl":"https://registry.npmjs.org/ws/-/ws-8.22.0.tgz"},"preparation":{"id":"a42184ac-e76c-4659-aff4-082f033ad867","outcome":"pass","failure":null,"profileRevision":"npm_11_19_0_linux_amd64_v2","snapshot":{"id":"339cb5b7-a287-4c56-abe0-dbf468257d88","generation":"3d721991-a3a2-4342-be87-318836fef00a","lockDigest":"58bd5e0d089c72e820da832f6ff4408242816cedd703e2339d89f396745dc470","treeDigest":"eeac9a87d86ae44c393b1d4d255d6affdadf262ca93ed58df868c5e68a8712f8","profileRevision":"npm_11_19_0_linux_amd64_v2","installerImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7"},"installedCount":1,"omittedOptionalCount":0,"staticObservations":{"native":{"count":0,"paths":[],"buildIndicators":[],"prerequisiteProven":false},"declared":{"main":"index.js","engines":{"node":">=10.0.0"},"exports":{".":{"import":"./wrapper.mjs","browser":"./browser.js","require":"./index.js"},"./package.json":"./package.json"},"scripts":{"lint":"eslint . && prettier --check --ignore-path .gitignore \"**/*.{json,md,yaml,yml}\"","test":"nyc --reporter=lcov --reporter=text mocha --throw-deprecation test/*.test.js","integration":"mocha --throw-deprecation test/*.integration.js"},"devDependencies":{"nyc":"^15.0.0","mocha":"^8.4.0","eslint":"^10.0.1","globals":"^17.0.0","prettier":"^3.0.0","benchmark":"^2.1.4","@eslint/js":"^10.0.1","bufferutil":"^4.0.1","utf-8-validate":"^6.0.0","eslint-config-prettier":"^10.0.1","eslint-plugin-prettier":"^5.0.0"},"peerDependencies":{"bufferutil":"^4.0.1","utf-8-validate":">=5.0.2"},"peerDependenciesMeta":{"bufferutil":{"optional":true},"utf-8-validate":{"optional":true}}},"platform":{"os":true,"cpu":true,"libc":true},"evidenceLevel":"static_only","lifecycleScripts":[]}},"matrix":{"id":"bfab88d7-3f4a-41b5-97a9-5aafd5bda511","revision":"production_ab51508deb208994caf81cb80f14b800","platform":"linux_amd64_glibc","harnessRevision":"load_v2","planRevision":"explicit_exports_v1","policyRevision":"runtime_limits_v2","images":[{"profileId":"node_24_21_0","kind":"node","version":"24.21.0","imageId":"sha256:f2fcbb4dfbd6d5f57f4e43de97e70182d9982ac7cc0cc063dfff2cf1759a411d","builtAt":"2026-10-04T15:20:38.392Z","sourceImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"node_26_10_0","kind":"node","version":"26.10.0","imageId":"sha256:9c1c93cc35d1408d26a61c4efccbde37c35425e362a2e723b885c3333d2be073","builtAt":"2026-10-04T15:20:47.161Z","sourceImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"bun_1_4_2","kind":"bun","version":"1.4.2","imageId":"sha256:2343363679fb92d59a395ff081b783b5514f06295b1bc6d61baaeef17e793789","builtAt":"2026-10-04T15:21:07.160Z","sourceImage":"oven/bun:1.4.2-debian@sha256:53710ce0f14eef8312521c586a7ae1d9aeab4011840f09f1966073b68fc2e2ab","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"deno_2_9_7","kind":"deno","version":"2.9.7","imageId":"sha256:4292bb23555f98fb9dfc30fb447daa1c301686d89264fd8643ccb86bc0d53c29","builtAt":"2026-10-04T15:21:22.570Z","sourceImage":"denoland/deno:debian-2.9.7@sha256:869d374bdaddda4fde029c492d7219199b0e821c2c53cca5357b3a6f5b9336fc","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"}]},"omissions":{"counts":{"pattern":0,"non_executable":1,"not_exported":0,"invalid_subpath":0,"coverage_limit":0},"samples":[{"subpath":"./package.json","reason":"non_executable"}]},"outcome":"pass","evidenceLevel":"smoke_tested","coverageComplete":true,"cells":[{"runId":"b1c0126b-16a7-4503-93a7-ad7920728693","profileId":"node_24_21_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":476.0564660001546,"failure":null,"entries":[{"index":0,"specifier":"ws","displaySpecifier":"ws","outcome":"pass","durationMs":19.054418000000002,"resolvedTo":"file:///workspace/node_modules/ws/wrapper.mjs","failure":null}],"sessions":[{"probeId":"93d16e32-4d26-4dd0-8873-d527d2e35757","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":476.0564660001546}]},{"runId":"a3ab5273-d3a3-4e74-9e64-b749cf5a58be","profileId":"node_24_21_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":459.1379579999484,"failure":null,"entries":[{"index":0,"specifier":"ws","displaySpecifier":"ws","outcome":"pass","durationMs":15.787304999999996,"resolvedTo":"/workspace/node_modules/ws/index.js","failure":null}],"sessions":[{"probeId":"bdb47a85-d488-4386-8bf4-1a96e35d8630","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":459.1379579999484}]},{"runId":"3de15662-ce38-44fd-9103-aee145cf356e","profileId":"node_24_21_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"5d5f1da7-4468-47a4-a791-4e9f600371ba","profileId":"node_24_21_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"0a59d5bf-e37f-4b36-a586-b883973acf1a","profileId":"node_26_10_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":518.1194799998775,"failure":null,"entries":[{"index":0,"specifier":"ws","displaySpecifier":"ws","outcome":"pass","durationMs":21.471822000000003,"resolvedTo":"file:///workspace/node_modules/ws/wrapper.mjs","failure":null}],"sessions":[{"probeId":"aa28087f-db21-4413-bdfb-6a74c13ae5b6","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":518.1194799998775}]},{"runId":"f552e81c-7522-447e-8cf0-b0850e7863dd","profileId":"node_26_10_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":311.94685800001025,"failure":null,"entries":[{"index":0,"specifier":"ws","displaySpecifier":"ws","outcome":"pass","durationMs":27.354877,"resolvedTo":"/workspace/node_modules/ws/index.js","failure":null}],"sessions":[{"probeId":"788f4485-adf9-42d4-be36-d7d44323958c","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":311.94685800001025}]},{"runId":"8973175c-5a33-4e77-a7e2-44b6b9fac579","profileId":"node_26_10_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"210f989f-9b27-4d56-a1a9-d811bace4e4f","profileId":"node_26_10_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"1af5997d-502b-4c42-bfc9-1d80a1731344","profileId":"bun_1_4_2","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":316.0042019998655,"failure":null,"entries":[{"index":0,"specifier":"ws","displaySpecifier":"ws","outcome":"pass","durationMs":1.4458879999999992,"resolvedTo":"ws","failure":null}],"sessions":[{"probeId":"1e8384f4-c855-4ab7-91aa-c13ea3df1b7a","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":316.0042019998655}]},{"runId":"b2d42018-6f3e-4fd1-8aaf-c227f8e8186a","profileId":"bun_1_4_2","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":320.3929310000967,"failure":null,"entries":[{"index":0,"specifier":"ws","displaySpecifier":"ws","outcome":"pass","durationMs":1.7490949999999996,"resolvedTo":"ws","failure":null}],"sessions":[{"probeId":"ab92730d-e1eb-44c7-a554-086b44e166b5","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":320.3929310000967}]},{"runId":"cd55ab0d-51a2-4dd6-8fa4-cb4977406f3e","profileId":"bun_1_4_2","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"b9778dd8-6437-4d59-8346-ac12bf808223","profileId":"bun_1_4_2","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"74ea63ca-18d2-457f-9e92-1421f527f0bc","profileId":"deno_2_9_7","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":553.2642120001838,"failure":null,"entries":[{"index":0,"specifier":"ws","displaySpecifier":"ws","outcome":"pass","durationMs":80.02392999999998,"resolvedTo":"file:///workspace/node_modules/ws/wrapper.mjs","failure":null}],"sessions":[{"probeId":"c978c41c-bde6-4425-98e2-4c0d9c42d9b1","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":553.2642120001838}]},{"runId":"93618ad8-9af5-4bfa-a7ce-975f131baf57","profileId":"deno_2_9_7","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":476.59607400000095,"failure":null,"entries":[{"index":0,"specifier":"ws","displaySpecifier":"ws","outcome":"pass","durationMs":26.22273,"resolvedTo":"/workspace/node_modules/ws/index.js","failure":null}],"sessions":[{"probeId":"53810f55-da77-4322-b91b-a6077dbac3ae","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":476.59607400000095}]},{"runId":"e93269fe-e385-46e1-8bcd-12af4de102b6","profileId":"deno_2_9_7","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"c213c25f-026c-4026-bd91-7eab0135c872","profileId":"deno_2_9_7","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]}],"limitations":["Only installation and loading were observed; functional correctness and package safety are not established.","Subpath batches share module caches and globals; root modes use separate fresh sandboxes.","Package-visible harness observations can be tampered with. They are not adversarial attestation.","Evidence applies to these exact artifacts, dependency snapshot, runtime images and Linux amd64/glibc policy.","Runtime error codes are captured observations and can also be thrown by package code."]}}