{"schemaVersion":1,"status":{"id":"9a5615c8-ec6c-4b1f-8817-d5febb04890c","scanId":"bbb4c8bd-22bf-4bea-a51e-68658a3bef7d","invalidatedAt":null,"invalidationReason":null,"replacedBy":null,"snapshotAvailable":true,"policyAllowed":true,"createdAt":"2026-10-12T22:55:56.423Z","observationRevision":0,"previousScanId":null,"previousReportId":null,"current":true},"report":{"schemaVersion":1,"id":"9a5615c8-ec6c-4b1f-8817-d5febb04890c","scanId":"bbb4c8bd-22bf-4bea-a51e-68658a3bef7d","classifierRevision":"classifier_v3","observedAt":"2026-10-12T22:55:54.595Z","classifiedAt":"2026-10-12T22:55:56.429Z","artifact":{"name":"express","version":"5.3.0","integrity":"sha512-qCqy1xSoaugxOD4IVHb1ZWdkvCF2W3aE2okKouWj8VwJ+ztskSiXoBnCSJqfKT+cVPJhuJqe9YLbY425+Zh00g==","tarballUrl":"https://registry.npmjs.org/express/-/express-5.3.0.tgz"},"preparation":{"id":"21d048b7-469b-4cb7-a52a-a165cc84539b","outcome":"pass","failure":null,"profileRevision":"npm_11_19_0_linux_amd64_v2","snapshot":{"id":"b9c2130e-9708-48da-9f1b-97697f9e6155","generation":"48618c60-d1e9-4469-b4d8-ae0014b13cec","lockDigest":"cb9036b55b12736f412e2c1741b269434ae21b856724619ad80af3285e96b7d7","treeDigest":"b730b4bea70d400fa5de829242a1c80583d724cd4a9b58deeaa41616f26b5d11","profileRevision":"npm_11_19_0_linux_amd64_v2","installerImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7"},"installedCount":65,"omittedOptionalCount":0,"staticObservations":{"native":{"count":0,"paths":[],"buildIndicators":[],"prerequisiteProven":false},"declared":{"engines":{"node":">= 18"},"scripts":{"lint":"eslint .","test":"mocha --require test/support/env --reporter spec --check-leaks test/ test/acceptance/","test-ci":"nyc --exclude examples --exclude test --exclude benchmarks --reporter=lcovonly --reporter=text npm test","lint:fix":"eslint . --fix","test-cov":"nyc --exclude examples --exclude test --exclude benchmarks --reporter=html --reporter=text npm test","test-tap":"mocha --require test/support/env --reporter tap --check-leaks test/ test/acceptance/"},"dependencies":{"qs":"^6.16.0","depd":"^2.0.0","etag":"^1.8.1","once":"^1.4.0","send":"^1.1.0","vary":"^1.1.2","debug":"^4.4.0","fresh":"^2.0.0","cookie":"^0.7.1","router":"^2.2.0","accepts":"^2.0.0","type-is":"^2.1.0","parseurl":"^1.3.3","statuses":"^2.0.1","encodeurl":"^2.0.0","mime-types":"^3.0.0","proxy-addr":"^2.0.8","body-parser":"^2.3.0","escape-html":"^1.0.3","http-errors":"^2.0.0","on-finished":"^2.4.1","content-type":"^2.0.0","finalhandler":"^2.1.0","range-parser":"^1.2.1","serve-static":"^2.2.0","cookie-signature":"^1.2.1","merge-descriptors":"^2.0.0","content-disposition":"^2.0.1"},"devDependencies":{"ejs":"^3.1.10","hbs":"4.3.1","nyc":"^17.1.0","after":"0.8.2","mocha":"^11.7.5","vhost":"~3.0.2","eslint":"8.47.0","marked":"^15.0.3","morgan":"1.12.1","supertest":"^6.3.0","connect-redis":"^8.0.1","cookie-parser":"1.4.7","cookie-session":"2.1.1","express-session":"^1.18.1","method-override":"3.0.0","pbkdf2-password":"1.2.1"}},"platform":{"os":true,"cpu":true,"libc":true},"evidenceLevel":"static_only","lifecycleScripts":[]}},"matrix":{"id":"8b9775d8-5acc-4186-a456-b008ad7a2ffa","revision":"production_2db44d825b68aeb5839111e38b0ad23c","platform":"linux_amd64_glibc","harnessRevision":"load_v2","planRevision":"explicit_exports_v1","policyRevision":"runtime_limits_v2","images":[{"profileId":"node_24_21_0","kind":"node","version":"24.21.0","imageId":"sha256:12a6a4db05cc9f4f55fe7e4731983c5476658c748b722cac3332c4bfc986c2f1","builtAt":"2026-10-04T15:20:38.392Z","sourceImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"node_26_10_0","kind":"node","version":"26.10.0","imageId":"sha256:8cef3b37b8edb5af9da80cb7416bd2c8b35b87fea1bc72c9abbb204ee000bd9c","builtAt":"2026-10-04T15:20:47.161Z","sourceImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"bun_1_4_2","kind":"bun","version":"1.4.2","imageId":"sha256:6d19a3cc65d5015ba20193b7610af27ad603eed4ea29caf4dd4ccc04ad5ca7ef","builtAt":"2026-10-04T15:21:07.160Z","sourceImage":"oven/bun:1.4.2-debian@sha256:53710ce0f14eef8312521c586a7ae1d9aeab4011840f09f1966073b68fc2e2ab","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"deno_2_9_7","kind":"deno","version":"2.9.7","imageId":"sha256:1a5c5f412e04bff71a674b122f4216fac988b0fddc9d36be588224490adc292e","builtAt":"2026-10-04T15:21:22.570Z","sourceImage":"denoland/deno:debian-2.9.7@sha256:869d374bdaddda4fde029c492d7219199b0e821c2c53cca5357b3a6f5b9336fc","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"}]},"omissions":{"counts":{"pattern":0,"non_executable":0,"not_exported":0,"invalid_subpath":0,"coverage_limit":0},"samples":[]},"outcome":"pass","evidenceLevel":"smoke_tested","coverageComplete":true,"cells":[{"runId":"d3afce7c-5f24-407d-8cfa-1f053814ade8","profileId":"node_24_21_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":445.9076000000059,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":95.23684200000001,"resolvedTo":"file:///workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"f0acc0ec-c128-4103-a197-0271cc55cb5c","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":445.9076000000059}]},{"runId":"df1d0b5c-41f1-4ab1-ab8a-0fc57392a8e7","profileId":"node_24_21_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":453.38773899999796,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":110.05511699999998,"resolvedTo":"/workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"96501822-f628-4284-bf87-d4a026caba5b","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":453.38773899999796}]},{"runId":"2e1433d4-da6c-4427-b817-0aecb353fbed","profileId":"node_24_21_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"3210a7fe-a7ce-4b29-aa14-784df279e9c7","profileId":"node_24_21_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"4721504c-55c1-44f8-94f4-0541459709d5","profileId":"node_26_10_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":439.20356699998956,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":76.032461,"resolvedTo":"file:///workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"afa27b1a-1b60-4aa5-8074-584f603c23f0","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":439.20356699998956}]},{"runId":"243d8fef-32c3-4e44-a783-94026cfefdf9","profileId":"node_26_10_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":420.808526000008,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":104.62546499999999,"resolvedTo":"/workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"95b837b6-e783-4a91-af8b-529f15599a72","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":420.808526000008}]},{"runId":"9f016f8f-c1f7-417b-a632-9d739fd98b4f","profileId":"node_26_10_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"682c4da9-04a5-4634-90d5-f142e3f3aec1","profileId":"node_26_10_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"ab9c5b67-e7ed-47a0-9c68-d53c31b79487","profileId":"bun_1_4_2","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":465.5188879999914,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":101.465366,"resolvedTo":"file:///workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"9d12a8db-8075-4f2a-9b36-ee2f139a68fb","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":465.5188879999914}]},{"runId":"43e03d34-2114-4138-ae46-0d07fa9f45b5","profileId":"bun_1_4_2","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":440.96327599999495,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":108.397862,"resolvedTo":"/workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"1e0ab260-19a4-473d-8487-6953ba2e7131","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":440.96327599999495}]},{"runId":"f6d66c17-7628-4ec3-81f6-090f6ea73549","profileId":"bun_1_4_2","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"63ce1658-3f3b-4c18-8291-5c002745d249","profileId":"bun_1_4_2","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"33f0b7ea-95bd-42a0-8fcd-0b466cecbd87","profileId":"deno_2_9_7","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":628.6644320000196,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":174.425662,"resolvedTo":"file:///workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"9d131e0c-997c-4a58-a5a4-cf07f30ce042","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":628.6644320000196}]},{"runId":"c7bf4909-8b13-493d-947b-3c4e17b75c19","profileId":"deno_2_9_7","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":615.3829430000042,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":144.405035,"resolvedTo":"/workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"4a3934e1-12a5-4936-bf52-35bda5ec041a","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":615.3829430000042}]},{"runId":"188513ee-a360-4684-b87a-36fb297dde3e","profileId":"deno_2_9_7","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"79853afe-5126-4b01-8f03-7a37ea83f451","profileId":"deno_2_9_7","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"isolationPassed":0,"isolationUnconfirmed":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]}],"limitations":["Only installation and loading were observed; functional correctness and package safety are not established.","Subpath batches share module caches and globals; root modes use separate fresh sandboxes.","Package-visible harness observations can be tampered with. They are not adversarial attestation.","Evidence applies to these exact artifacts, dependency snapshot, runtime images and Linux amd64/glibc policy.","Runtime error codes are captured observations and can also be thrown by package code."]}}