{"schemaVersion":1,"status":{"id":"9368053f-f1bb-43cc-95e0-7c8e938fcb4c","scanId":"4528fcd7-610c-4c0a-ba3e-4c997d9a0363","invalidatedAt":null,"invalidationReason":null,"replacedBy":null,"snapshotAvailable":true,"policyAllowed":true,"createdAt":"2026-10-05T09:27:41.871Z","observationRevision":0,"previousScanId":null,"previousReportId":null,"current":true},"report":{"schemaVersion":1,"id":"9368053f-f1bb-43cc-95e0-7c8e938fcb4c","scanId":"4528fcd7-610c-4c0a-ba3e-4c997d9a0363","classifierRevision":"classifier_v1","observedAt":"2026-10-05T09:27:41.664Z","classifiedAt":"2026-10-05T09:27:41.875Z","artifact":{"name":"express","version":"5.2.1","integrity":"sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==","tarballUrl":"https://registry.npmjs.org/express/-/express-5.2.1.tgz"},"preparation":{"id":"7fc60684-0fde-4c37-947a-6eaf4e944251","outcome":"pass","failure":null,"profileRevision":"npm_11_19_0_linux_amd64_v2","snapshot":{"id":"fd9fed3a-6c2a-46d8-b108-4fe573080ec3","generation":"a9c89aa1-e5e9-4209-8ddf-09af18b47c18","lockDigest":"19a9ae214205bc5b6d3590fcaf79cee68a7b18a7ae534529b0860057474a23b6","treeDigest":"3181a2403cb4b1ba01fc1e81cbea4caeed8010292700fe96e035f87debe22661","profileRevision":"npm_11_19_0_linux_amd64_v2","installerImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7"},"installedCount":68,"omittedOptionalCount":0,"staticObservations":{"native":{"count":0,"paths":[],"buildIndicators":[],"prerequisiteProven":false},"declared":{"engines":{"node":">= 18"},"scripts":{"lint":"eslint .","test":"mocha --require test/support/env --reporter spec --check-leaks test/ test/acceptance/","test-ci":"nyc --exclude examples --exclude test --exclude benchmarks --reporter=lcovonly --reporter=text npm test","lint:fix":"eslint . --fix","test-cov":"nyc --exclude examples --exclude test --exclude benchmarks --reporter=html --reporter=text npm test","test-tap":"mocha --require test/support/env --reporter tap --check-leaks test/ test/acceptance/"},"dependencies":{"qs":"^6.14.0","depd":"^2.0.0","etag":"^1.8.1","once":"^1.4.0","send":"^1.1.0","vary":"^1.1.2","debug":"^4.4.0","fresh":"^2.0.0","cookie":"^0.7.1","router":"^2.2.0","accepts":"^2.0.0","type-is":"^2.0.1","parseurl":"^1.3.3","statuses":"^2.0.1","encodeurl":"^2.0.0","mime-types":"^3.0.0","proxy-addr":"^2.0.7","body-parser":"^2.2.1","escape-html":"^1.0.3","http-errors":"^2.0.0","on-finished":"^2.4.1","content-type":"^1.0.5","finalhandler":"^2.1.0","range-parser":"^1.2.1","serve-static":"^2.2.0","cookie-signature":"^1.2.1","merge-descriptors":"^2.0.0","content-disposition":"^1.0.0"},"devDependencies":{"ejs":"^3.1.10","hbs":"4.2.0","nyc":"^17.1.0","after":"0.8.2","mocha":"^10.7.3","vhost":"~3.0.2","eslint":"8.47.0","marked":"^15.0.3","morgan":"1.10.1","supertest":"^6.3.0","connect-redis":"^8.0.1","cookie-parser":"1.4.7","cookie-session":"2.1.1","express-session":"^1.18.1","method-override":"3.0.0","pbkdf2-password":"1.2.1"}},"platform":{"os":true,"cpu":true,"libc":true},"evidenceLevel":"static_only","lifecycleScripts":[]}},"matrix":{"id":"564702fd-e123-4877-a360-197eb82a080c","revision":"production_2ba9975ad9c71536584c3dbe5bc19835","platform":"linux_amd64_glibc","harnessRevision":"load_v2","planRevision":"explicit_exports_v1","policyRevision":"runtime_limits_v2","images":[{"profileId":"node_24_21_0","kind":"node","version":"24.21.0","imageId":"sha256:407735cec113e107f7b84805611643f1c455d52881587558f59aac3290c4df93","builtAt":"2026-10-04T15:20:38.392Z","sourceImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"node_26_10_0","kind":"node","version":"26.10.0","imageId":"sha256:b94c9b04814509d02f1e0578a76c1beb088616e10e859f0c059b66a974db1606","builtAt":"2026-10-04T15:20:47.161Z","sourceImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"bun_1_4_2","kind":"bun","version":"1.4.2","imageId":"sha256:b2cc30887aa06e64c39c99ca452e89b837d363a9b04f4452cdbb338949d41d74","builtAt":"2026-10-04T15:21:07.160Z","sourceImage":"oven/bun:1.4.2-debian@sha256:53710ce0f14eef8312521c586a7ae1d9aeab4011840f09f1966073b68fc2e2ab","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"deno_2_9_7","kind":"deno","version":"2.9.7","imageId":"sha256:a678340f8ccec6b28f57c9bd272443be4d95ec33cd7792590694fc1dfccf22ab","builtAt":"2026-10-04T15:21:22.570Z","sourceImage":"denoland/deno:debian-2.9.7@sha256:869d374bdaddda4fde029c492d7219199b0e821c2c53cca5357b3a6f5b9336fc","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"}]},"omissions":{"counts":{"pattern":0,"non_executable":0,"not_exported":0,"invalid_subpath":0,"coverage_limit":0},"samples":[]},"outcome":"pass","evidenceLevel":"smoke_tested","coverageComplete":true,"cells":[{"runId":"b42e117e-5b7a-4bd6-b2f1-75503ab2aee3","profileId":"node_24_21_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":519.3201570000092,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":128.995979,"resolvedTo":"file:///workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"5c564a15-9cf6-497b-9204-07715ea8d7ca","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":519.3201570000092}]},{"runId":"c10b7b9a-30dd-4463-8086-674446a4c65f","profileId":"node_24_21_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":424.7121139999945,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":80.999065,"resolvedTo":"/workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"3991718a-b341-45c1-b45f-27f74fc7e665","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":424.7121139999945}]},{"runId":"fada3d41-cd39-448b-a6f5-f5e2179f4969","profileId":"node_24_21_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"e3d2a3c3-2f64-4360-95e4-e6174a3007f3","profileId":"node_24_21_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"ab8559fd-7efc-4e92-946a-f3cee4f28329","profileId":"node_26_10_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":434.4921349999786,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":94.25194099999999,"resolvedTo":"file:///workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"7850b2d0-1b7d-4def-b287-a7b7aa2dfc62","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":434.4921349999786}]},{"runId":"75e9ae12-6452-469a-9039-db42bb4cf791","profileId":"node_26_10_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":437.66737800001283,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":112.287624,"resolvedTo":"/workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"e6934a64-51ac-452a-bac8-83a8cb78bb3d","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":437.66737800001283}]},{"runId":"b8319edc-ed64-4ee6-a8e2-53a5576759bd","profileId":"node_26_10_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"aa591094-9ebe-4c3c-a5ef-a9beff5827d6","profileId":"node_26_10_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"156dbe8b-481a-4f8f-af48-a1bc4425f878","profileId":"bun_1_4_2","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":413.1229709999752,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":85.14071100000001,"resolvedTo":"file:///workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"2b7a292f-20ff-4337-93ca-0a28317478c1","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":413.1229709999752}]},{"runId":"a4806c6b-4d13-4084-a18f-1618b464a33c","profileId":"bun_1_4_2","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":660.5026209999924,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":108.42657700000001,"resolvedTo":"/workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"40014f36-90f7-462e-9d3c-8c053825ac62","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":660.5026209999924}]},{"runId":"2396a66c-a82c-4f53-a5d5-f8a4ab7a80bf","profileId":"bun_1_4_2","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"8b849d8b-e418-48f7-bea0-195694b45c99","profileId":"bun_1_4_2","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"8a26b13f-c8e3-4db5-8d35-9d5cdd56db22","profileId":"deno_2_9_7","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":715.1462699999975,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":142.23755,"resolvedTo":"file:///workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"8d37e132-3513-44dc-81a1-54f29c539033","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":715.1462699999975}]},{"runId":"9c7d837f-5ff6-4e22-9d19-9a2fe8511716","profileId":"deno_2_9_7","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":523.5663509999868,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":186.135448,"resolvedTo":"/workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"7f150e5f-343d-4c9f-8cb7-bdddcef7e287","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":523.5663509999868}]},{"runId":"559c6e2d-d2b2-4e2d-b40f-dd97c0a9f941","profileId":"deno_2_9_7","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"dc9ac198-bc9d-4193-b617-f9507eeda1bb","profileId":"deno_2_9_7","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]}],"limitations":["Only installation and loading were observed; functional correctness and package safety are not established.","Subpath batches share module caches and globals; root modes use separate fresh sandboxes.","Package-visible harness observations can be tampered with. They are not adversarial attestation.","Evidence applies to these exact artifacts, dependency snapshot, runtime images and Linux amd64/glibc policy.","Runtime error codes are captured observations and can also be thrown by package code."]}}