{"schemaVersion":1,"status":{"id":"da17ba56-ca33-481f-8f29-86524e4d35a2","scanId":"da71bd99-6ef2-44e7-9797-a21126fc57b7","invalidatedAt":null,"invalidationReason":null,"replacedBy":null,"snapshotAvailable":true,"policyAllowed":true,"createdAt":"2026-10-09T11:09:55.067Z","observationRevision":0,"previousScanId":null,"previousReportId":null,"current":true},"report":{"schemaVersion":1,"id":"da17ba56-ca33-481f-8f29-86524e4d35a2","scanId":"da71bd99-6ef2-44e7-9797-a21126fc57b7","classifierRevision":"classifier_v2","observedAt":"2026-10-09T11:09:53.180Z","classifiedAt":"2026-10-09T11:09:55.070Z","artifact":{"name":"express","version":"5.2.1","integrity":"sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==","tarballUrl":"https://registry.npmjs.org/express/-/express-5.2.1.tgz"},"preparation":{"id":"7fc60684-0fde-4c37-947a-6eaf4e944251","outcome":"pass","failure":null,"profileRevision":"npm_11_19_0_linux_amd64_v2","snapshot":{"id":"fd9fed3a-6c2a-46d8-b108-4fe573080ec3","generation":"a9c89aa1-e5e9-4209-8ddf-09af18b47c18","lockDigest":"19a9ae214205bc5b6d3590fcaf79cee68a7b18a7ae534529b0860057474a23b6","treeDigest":"3181a2403cb4b1ba01fc1e81cbea4caeed8010292700fe96e035f87debe22661","profileRevision":"npm_11_19_0_linux_amd64_v2","installerImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7"},"installedCount":68,"omittedOptionalCount":0,"staticObservations":{"native":{"count":0,"paths":[],"buildIndicators":[],"prerequisiteProven":false},"declared":{"engines":{"node":">= 18"},"scripts":{"lint":"eslint .","test":"mocha --require test/support/env --reporter spec --check-leaks test/ test/acceptance/","test-ci":"nyc --exclude examples --exclude test --exclude benchmarks --reporter=lcovonly --reporter=text npm test","lint:fix":"eslint . --fix","test-cov":"nyc --exclude examples --exclude test --exclude benchmarks --reporter=html --reporter=text npm test","test-tap":"mocha --require test/support/env --reporter tap --check-leaks test/ test/acceptance/"},"dependencies":{"qs":"^6.14.0","depd":"^2.0.0","etag":"^1.8.1","once":"^1.4.0","send":"^1.1.0","vary":"^1.1.2","debug":"^4.4.0","fresh":"^2.0.0","cookie":"^0.7.1","router":"^2.2.0","accepts":"^2.0.0","type-is":"^2.0.1","parseurl":"^1.3.3","statuses":"^2.0.1","encodeurl":"^2.0.0","mime-types":"^3.0.0","proxy-addr":"^2.0.7","body-parser":"^2.2.1","escape-html":"^1.0.3","http-errors":"^2.0.0","on-finished":"^2.4.1","content-type":"^1.0.5","finalhandler":"^2.1.0","range-parser":"^1.2.1","serve-static":"^2.2.0","cookie-signature":"^1.2.1","merge-descriptors":"^2.0.0","content-disposition":"^1.0.0"},"devDependencies":{"ejs":"^3.1.10","hbs":"4.2.0","nyc":"^17.1.0","after":"0.8.2","mocha":"^10.7.3","vhost":"~3.0.2","eslint":"8.47.0","marked":"^15.0.3","morgan":"1.10.1","supertest":"^6.3.0","connect-redis":"^8.0.1","cookie-parser":"1.4.7","cookie-session":"2.1.1","express-session":"^1.18.1","method-override":"3.0.0","pbkdf2-password":"1.2.1"}},"platform":{"os":true,"cpu":true,"libc":true},"evidenceLevel":"static_only","lifecycleScripts":[]}},"matrix":{"id":"bfab88d7-3f4a-41b5-97a9-5aafd5bda511","revision":"production_ab51508deb208994caf81cb80f14b800","platform":"linux_amd64_glibc","harnessRevision":"load_v2","planRevision":"explicit_exports_v1","policyRevision":"runtime_limits_v2","images":[{"profileId":"node_24_21_0","kind":"node","version":"24.21.0","imageId":"sha256:f2fcbb4dfbd6d5f57f4e43de97e70182d9982ac7cc0cc063dfff2cf1759a411d","builtAt":"2026-10-04T15:20:38.392Z","sourceImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"node_26_10_0","kind":"node","version":"26.10.0","imageId":"sha256:9c1c93cc35d1408d26a61c4efccbde37c35425e362a2e723b885c3333d2be073","builtAt":"2026-10-04T15:20:47.161Z","sourceImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"bun_1_4_2","kind":"bun","version":"1.4.2","imageId":"sha256:2343363679fb92d59a395ff081b783b5514f06295b1bc6d61baaeef17e793789","builtAt":"2026-10-04T15:21:07.160Z","sourceImage":"oven/bun:1.4.2-debian@sha256:53710ce0f14eef8312521c586a7ae1d9aeab4011840f09f1966073b68fc2e2ab","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"deno_2_9_7","kind":"deno","version":"2.9.7","imageId":"sha256:4292bb23555f98fb9dfc30fb447daa1c301686d89264fd8643ccb86bc0d53c29","builtAt":"2026-10-04T15:21:22.570Z","sourceImage":"denoland/deno:debian-2.9.7@sha256:869d374bdaddda4fde029c492d7219199b0e821c2c53cca5357b3a6f5b9336fc","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"}]},"omissions":{"counts":{"pattern":0,"non_executable":0,"not_exported":0,"invalid_subpath":0,"coverage_limit":0},"samples":[]},"outcome":"pass","evidenceLevel":"smoke_tested","coverageComplete":true,"cells":[{"runId":"9300f3df-1e94-4147-8f3e-321e3d808a9b","profileId":"node_24_21_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":511.026654999936,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":139.234531,"resolvedTo":"file:///workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"4a80f42c-8f5f-4ac0-a6b5-a588d86c1fe4","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":511.026654999936}]},{"runId":"cb680abe-a7a2-41ed-a880-8b3d95298be9","profileId":"node_24_21_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":440.10818600002676,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":116.873752,"resolvedTo":"/workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"feb6382f-7a80-48d8-8b97-2695e19a31d1","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":440.10818600002676}]},{"runId":"340faec9-bf8d-4e98-8c17-1982aecc3f16","profileId":"node_24_21_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"40c04b0b-3321-49b9-b03c-088a2a94e8b4","profileId":"node_24_21_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"9662125a-c0c0-4a6d-ab0d-6a25c72dfb38","profileId":"node_26_10_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":410.54948799987324,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":79.229855,"resolvedTo":"file:///workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"c126687c-4d52-49b1-91e6-b7d577db9a97","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":410.54948799987324}]},{"runId":"6d1bf1a3-ab58-4508-940d-69ec86b7d477","profileId":"node_26_10_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":421.22639600001276,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":115.260716,"resolvedTo":"/workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"03258433-4cf8-45eb-a71a-31d721d02051","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":421.22639600001276}]},{"runId":"7e21a7d5-771d-4d79-bdab-d3876c99cb48","profileId":"node_26_10_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"9838c875-09a3-4dd6-b03e-6801d3e91fee","profileId":"node_26_10_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"161be4a3-80e3-4cdc-8f10-0bc081f78e25","profileId":"bun_1_4_2","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":449.0780459998641,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":116.363675,"resolvedTo":"file:///workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"6a37b132-2295-4f80-af84-50d8f54be2b9","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":449.0780459998641}]},{"runId":"7c8d20c1-e29a-4acd-8bf6-a415a7979854","profileId":"bun_1_4_2","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":430.1628329998348,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":128.39679,"resolvedTo":"/workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"32399d31-0c1d-499f-92b9-19132edb7f89","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":430.1628329998348}]},{"runId":"d88d642a-a0da-4e06-bab8-aff2cd520085","profileId":"bun_1_4_2","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"a033fce2-529e-42bb-a526-7ccf8c09701c","profileId":"bun_1_4_2","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"89ee1905-3e14-4290-9e23-41978cf61bc3","profileId":"deno_2_9_7","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":650.9623560002074,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":212.52376999999998,"resolvedTo":"file:///workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"fec36533-e3cf-42dd-a5f5-8d39562695c3","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":650.9623560002074}]},{"runId":"d493f66e-7781-4a0a-a57b-acc528f8ee9a","profileId":"deno_2_9_7","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":684.2178519999143,"failure":null,"entries":[{"index":0,"specifier":"express","displaySpecifier":"express","outcome":"pass","durationMs":157.531232,"resolvedTo":"/workspace/node_modules/express/index.js","failure":null}],"sessions":[{"probeId":"5a843ce6-76ac-4e60-a87e-44af4f532cfd","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":684.2178519999143}]},{"runId":"b255d8cd-840c-4f59-978d-6423ab2a5cf2","profileId":"deno_2_9_7","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"1b59daa7-63ff-4f54-ba4e-65808a4604cd","profileId":"deno_2_9_7","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]}],"limitations":["Only installation and loading were observed; functional correctness and package safety are not established.","Subpath batches share module caches and globals; root modes use separate fresh sandboxes.","Package-visible harness observations can be tampered with. They are not adversarial attestation.","Evidence applies to these exact artifacts, dependency snapshot, runtime images and Linux amd64/glibc policy.","Runtime error codes are captured observations and can also be thrown by package code."]}}