{"schemaVersion":1,"status":{"id":"8156a77e-c655-4c95-bf26-5769bc4d9fad","scanId":"c63962d7-9081-45d6-b1d9-26accdf57f95","invalidatedAt":null,"invalidationReason":null,"replacedBy":null,"snapshotAvailable":true,"policyAllowed":true,"createdAt":"2026-10-05T06:12:13.642Z","observationRevision":0,"previousScanId":null,"previousReportId":null,"current":true},"report":{"schemaVersion":1,"id":"8156a77e-c655-4c95-bf26-5769bc4d9fad","scanId":"c63962d7-9081-45d6-b1d9-26accdf57f95","classifierRevision":"classifier_v1","observedAt":"2026-10-05T06:12:10.524Z","classifiedAt":"2026-10-05T06:12:13.645Z","artifact":{"name":"express","version":"5.2.1","integrity":"sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==","tarballUrl":"https://registry.npmjs.org/express/-/express-5.2.1.tgz"},"preparation":{"id":"7fc60684-0fde-4c37-947a-6eaf4e944251","outcome":"pass","failure":null,"profileRevision":"npm_11_19_0_linux_amd64_v2","snapshot":{"id":"fd9fed3a-6c2a-46d8-b108-4fe573080ec3","generation":"a9c89aa1-e5e9-4209-8ddf-09af18b47c18","lockDigest":"19a9ae214205bc5b6d3590fcaf79cee68a7b18a7ae534529b0860057474a23b6","treeDigest":"3181a2403cb4b1ba01fc1e81cbea4caeed8010292700fe96e035f87debe22661","profileRevision":"npm_11_19_0_linux_amd64_v2","installerImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7"},"installedCount":68,"omittedOptionalCount":0,"staticObservations":{"native":{"count":0,"paths":[],"buildIndicators":[],"prerequisiteProven":false},"declared":{"engines":{"node":">= 18"},"scripts":{"lint":"eslint .","test":"mocha --require test/support/env --reporter spec --check-leaks test/ test/acceptance/","test-ci":"nyc --exclude examples --exclude test --exclude benchmarks --reporter=lcovonly --reporter=text npm test","lint:fix":"eslint . --fix","test-cov":"nyc --exclude examples --exclude test --exclude benchmarks --reporter=html --reporter=text npm test","test-tap":"mocha --require test/support/env --reporter tap --check-leaks test/ test/acceptance/"},"dependencies":{"qs":"^6.14.0","depd":"^2.0.0","etag":"^1.8.1","once":"^1.4.0","send":"^1.1.0","vary":"^1.1.2","debug":"^4.4.0","fresh":"^2.0.0","cookie":"^0.7.1","router":"^2.2.0","accepts":"^2.0.0","type-is":"^2.0.1","parseurl":"^1.3.3","statuses":"^2.0.1","encodeurl":"^2.0.0","mime-types":"^3.0.0","proxy-addr":"^2.0.7","body-parser":"^2.2.1","escape-html":"^1.0.3","http-errors":"^2.0.0","on-finished":"^2.4.1","content-type":"^1.0.5","finalhandler":"^2.1.0","range-parser":"^1.2.1","serve-static":"^2.2.0","cookie-signature":"^1.2.1","merge-descriptors":"^2.0.0","content-disposition":"^1.0.0"},"devDependencies":{"ejs":"^3.1.10","hbs":"4.2.0","nyc":"^17.1.0","after":"0.8.2","mocha":"^10.7.3","vhost":"~3.0.2","eslint":"8.47.0","marked":"^15.0.3","morgan":"1.10.1","supertest":"^6.3.0","connect-redis":"^8.0.1","cookie-parser":"1.4.7","cookie-session":"2.1.1","express-session":"^1.18.1","method-override":"3.0.0","pbkdf2-password":"1.2.1"}},"platform":{"os":true,"cpu":true,"libc":true},"evidenceLevel":"static_only","lifecycleScripts":[]}},"matrix":{"id":"c18bed16-c2f6-4100-94c2-9117ac7bc2e5","revision":"production_f10071512e0e7e24c6867f11e90a7da0","platform":"linux_amd64_glibc","harnessRevision":"load_v2","planRevision":"explicit_exports_v1","policyRevision":"runtime_limits_v2","images":[{"profileId":"node_24_21_0","kind":"node","version":"24.21.0","imageId":"sha256:cb6150e21f96e0cced8169843922f9f0363d32d3be86393172958aeb9d653aac","builtAt":"2026-10-04T15:20:38.392Z","sourceImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"node_26_10_0","kind":"node","version":"26.10.0","imageId":"sha256:348bbebdc16cde773af001ccf9734936485091fadf0b6162224c796fbf343a81","builtAt":"2026-10-04T15:20:47.161Z","sourceImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"bun_1_4_2","kind":"bun","version":"1.4.2","imageId":"sha256:58846b11e3e63c83dd1bbfa12097e641025bd57febe737c2bfaf2962a63fbacb","builtAt":"2026-10-04T15:21:07.160Z","sourceImage":"oven/bun:1.4.2-debian@sha256:53710ce0f14eef8312521c586a7ae1d9aeab4011840f09f1966073b68fc2e2ab","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"deno_2_9_7","kind":"deno","version":"2.9.7","imageId":"sha256:d2ee9affe35ff6eb8d788fcdc202e2e74802a2936e9acdfc63cd6b7d2aea0777","builtAt":"2026-10-04T15:21:22.570Z","sourceImage":"denoland/deno:debian-2.9.7@sha256:869d374bdaddda4fde029c492d7219199b0e821c2c53cca5357b3a6f5b9336fc","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"}]},"omissions":{"counts":{"pattern":0,"non_executable":0,"not_exported":0,"invalid_subpath":0,"coverage_limit":0},"samples":[]},"outcome":"pass","evidenceLevel":"smoke_tested","coverageComplete":true,"cells":[{"runId":"7f1b88c4-2606-47e8-900c-2cb9007ff779","profileId":"node_24_21_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":561.8071020022035,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":119.028155,"resolvedTo":"file:///workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"aeb2c39b-9d18-446a-9462-035479f4346c","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":561.8071020022035}]},{"runId":"c47c4535-d683-4c00-8300-2794d2853849","profileId":"node_24_21_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":533.4215420000255,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":129.650591,"resolvedTo":"/workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"10a9b016-388e-41e9-851b-1cfe1593d26d","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":533.4215420000255}]},{"runId":"588beaa8-e1ee-4cb9-982a-056db916b846","profileId":"node_24_21_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"2268ed19-d9eb-4fc4-84e5-4420e8a636ed","profileId":"node_24_21_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"6203b49f-1abb-4f69-a710-eb0ee8511eac","profileId":"node_26_10_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":410.3156850002706,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":126.562691,"resolvedTo":"file:///workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"20281308-eccd-4da3-b1b2-78673ea2e6a6","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":410.3156850002706}]},{"runId":"54421a17-16e1-4904-98e4-d7415cf60af2","profileId":"node_26_10_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":519.4035169966519,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":143.49288,"resolvedTo":"/workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"4d77e43e-24aa-48cc-9a06-a7f06ccdfe29","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":519.4035169966519}]},{"runId":"6e7d3ae2-5115-4dc0-af9c-88f171db8f43","profileId":"node_26_10_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"8212f143-c9c7-4281-af41-fd388239542c","profileId":"node_26_10_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"e039bb51-16ba-40bf-9229-6e951077e19a","profileId":"bun_1_4_2","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":444.78711500018835,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":123.29440699999999,"resolvedTo":"file:///workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"c823a16d-336b-4658-934b-b376946c7551","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":444.78711500018835}]},{"runId":"272874af-beac-4138-9ba6-80072cea69ba","profileId":"bun_1_4_2","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":423.6848980002105,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":122.14543900000001,"resolvedTo":"/workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"235883ef-9228-405b-9921-d9c56771cdb0","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":423.6848980002105}]},{"runId":"0413a8f2-9ed8-4840-afb3-4abc2285d08d","profileId":"bun_1_4_2","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"8e7d623b-889b-4b43-9732-59c95ce7bc1a","profileId":"bun_1_4_2","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"32a68044-a95b-48e4-8162-58ad7f1b7131","profileId":"deno_2_9_7","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":612.7605790011585,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":211.82981599999997,"resolvedTo":"file:///workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"3c81ab52-b560-4b8a-ad4a-419424e17cf2","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":612.7605790011585}]},{"runId":"da9f161b-ed44-4729-a0f5-202d5495490c","profileId":"deno_2_9_7","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":612.1615599989891,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":214.11458599999997,"resolvedTo":"/workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"a0a0ef87-cf6d-4fe4-a6dd-274240b55fd0","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":612.1615599989891}]},{"runId":"e6baa292-6ea3-409a-b912-be89a396b4ce","profileId":"deno_2_9_7","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"db9b08fa-f2d7-4c43-a831-73f9d0634c5f","profileId":"deno_2_9_7","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]}],"limitations":["Only installation and loading were observed; functional correctness and package safety are not established.","Subpath batches share module caches and globals; root modes use separate fresh sandboxes.","Package-visible harness observations can be tampered with. They are not adversarial attestation.","Evidence applies to these exact artifacts, dependency snapshot, runtime images and Linux amd64/glibc policy.","Runtime error codes are captured observations and can also be thrown by package code."]}}