{"schemaVersion":1,"status":{"id":"dd6a1163-7276-4510-a2f5-be11d5c88e4d","scanId":"615c43a9-aa3b-4439-aa1b-c723b23501b2","invalidatedAt":null,"invalidationReason":null,"replacedBy":null,"snapshotAvailable":true,"policyAllowed":true,"createdAt":"2026-10-09T05:14:37.366Z","observationRevision":0,"previousScanId":null,"previousReportId":null,"current":true},"report":{"schemaVersion":1,"id":"dd6a1163-7276-4510-a2f5-be11d5c88e4d","scanId":"615c43a9-aa3b-4439-aa1b-c723b23501b2","classifierRevision":"classifier_v2","observedAt":"2026-10-05T06:41:03.711Z","classifiedAt":"2026-10-09T05:14:37.373Z","artifact":{"name":"vm2","version":"3.12.2","integrity":"sha512-LRHt4xU6eXshlZEcSZVrTehLGxRDjHvjmFPGwEp4xGpZX61QzH6Xm9wK2nU7XAp36V1w2xILAL1LwxVkgD1Ipw==","tarballUrl":"https://registry.npmjs.org/vm2/-/vm2-3.12.2.tgz"},"preparation":{"id":"6f52f602-88f6-4bd5-8d4b-90779d866c80","outcome":"pass","failure":null,"profileRevision":"npm_11_19_0_linux_amd64_v2","snapshot":{"id":"c8974f6a-3757-4a04-a7fd-fe9a4f1edc56","generation":"9db33c6c-6b1b-4adb-8465-bbc08456685d","lockDigest":"eb1d32cd3c715754edb3be1a1984363c6b1f5759da996c47b741fd7cdab4c5b4","treeDigest":"2bcdc47d6cfc09d58a7a14db5799e3b3e7b4fd797867166e2beeac81b63d28a6","profileRevision":"npm_11_19_0_linux_amd64_v2","installerImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7"},"installedCount":3,"omittedOptionalCount":0,"staticObservations":{"native":{"count":0,"paths":[],"buildIndicators":[],"prerequisiteProven":false},"declared":{"bin":{"vm2":"./bin/vm2"},"main":"index.js","engines":{"node":">=6.0"},"scripts":{"lint":"eslint .","test":"mocha test --recursive --ignore test/compilers.js --require ./test/bun-setup.js","pretest":"node scripts/build-sources.js","build:sources":"node scripts/build-sources.js","prepublishOnly":"node scripts/build-sources.js","test:compilers":"mocha test/compilers.js"},"dependencies":{"acorn":"^8.15.0","acorn-walk":"^8.3.4"},"devDependencies":{"mocha":"^12.0.0-beta-9.2","eslint":"^9.38.0"}},"platform":{"os":true,"cpu":true,"libc":true},"evidenceLevel":"static_only","lifecycleScripts":[]}},"matrix":{"id":"c18bed16-c2f6-4100-94c2-9117ac7bc2e5","revision":"production_f10071512e0e7e24c6867f11e90a7da0","platform":"linux_amd64_glibc","harnessRevision":"load_v2","planRevision":"explicit_exports_v1","policyRevision":"runtime_limits_v2","images":[{"profileId":"node_24_21_0","kind":"node","version":"24.21.0","imageId":"sha256:cb6150e21f96e0cced8169843922f9f0363d32d3be86393172958aeb9d653aac","builtAt":"2026-10-04T15:20:38.392Z","sourceImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"node_26_10_0","kind":"node","version":"26.10.0","imageId":"sha256:348bbebdc16cde773af001ccf9734936485091fadf0b6162224c796fbf343a81","builtAt":"2026-10-04T15:20:47.161Z","sourceImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"bun_1_4_2","kind":"bun","version":"1.4.2","imageId":"sha256:58846b11e3e63c83dd1bbfa12097e641025bd57febe737c2bfaf2962a63fbacb","builtAt":"2026-10-04T15:21:07.160Z","sourceImage":"oven/bun:1.4.2-debian@sha256:53710ce0f14eef8312521c586a7ae1d9aeab4011840f09f1966073b68fc2e2ab","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"deno_2_9_7","kind":"deno","version":"2.9.7","imageId":"sha256:d2ee9affe35ff6eb8d788fcdc202e2e74802a2936e9acdfc63cd6b7d2aea0777","builtAt":"2026-10-04T15:21:22.570Z","sourceImage":"denoland/deno:debian-2.9.7@sha256:869d374bdaddda4fde029c492d7219199b0e821c2c53cca5357b3a6f5b9336fc","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"}]},"omissions":{"counts":{"pattern":0,"non_executable":0,"not_exported":0,"invalid_subpath":0,"coverage_limit":0},"samples":[]},"outcome":"pass","evidenceLevel":"smoke_tested","coverageComplete":true,"cells":[{"runId":"20b644fa-801b-47b8-b982-190a850a81fd","profileId":"node_24_21_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":308.58130900003016,"failure":null,"entries":[{"index":0,"specifier":"vm2","displaySpecifier":"vm2","outcome":"pass","durationMs":22.542758000000003,"resolvedTo":"file:///workspace/node_modules/vm2/index.js","failure":null}],"sessions":[{"probeId":"0946b09b-ffc2-42e9-9087-26e6c63fa604","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":308.58130900003016}]},{"runId":"c1303e31-85df-40de-89c6-a092f247b05a","profileId":"node_24_21_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":311.64522299997043,"failure":null,"entries":[{"index":0,"specifier":"vm2","displaySpecifier":"vm2","outcome":"pass","durationMs":26.798758000000003,"resolvedTo":"/workspace/node_modules/vm2/index.js","failure":null}],"sessions":[{"probeId":"bf13c78c-91b2-42dd-a3c9-c303addecfcb","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":311.64522299997043}]},{"runId":"2d5ac9bf-2a68-49da-b70c-2201fbe3d984","profileId":"node_24_21_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"cf41b8e6-741f-4f79-92e6-6f4e9b7b94a2","profileId":"node_24_21_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"3e68210a-522c-4544-baa8-b140144b0c17","profileId":"node_26_10_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":414.10968100000173,"failure":null,"entries":[{"index":0,"specifier":"vm2","displaySpecifier":"vm2","outcome":"pass","durationMs":27.826045999999998,"resolvedTo":"file:///workspace/node_modules/vm2/index.js","failure":null}],"sessions":[{"probeId":"0be2a2a6-e242-4913-9f1e-e6ed25b7efc7","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":414.10968100000173}]},{"runId":"351a547f-ea5e-4dd4-ac95-f9b05123c51f","profileId":"node_26_10_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":333.2750530000194,"failure":null,"entries":[{"index":0,"specifier":"vm2","displaySpecifier":"vm2","outcome":"pass","durationMs":22.891389,"resolvedTo":"/workspace/node_modules/vm2/index.js","failure":null}],"sessions":[{"probeId":"e987c535-dbf7-40c4-a7f7-9ba33387fb44","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":333.2750530000194}]},{"runId":"25376eca-5282-490b-bcc4-3eb5988a96ae","profileId":"node_26_10_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"b75925fa-d44e-4592-95bc-c17df46c3e6e","profileId":"node_26_10_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"fcf216b1-9755-48f4-a916-4bbe8dc6419f","profileId":"bun_1_4_2","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":324.9966930000228,"failure":null,"entries":[{"index":0,"specifier":"vm2","displaySpecifier":"vm2","outcome":"pass","durationMs":41.350494,"resolvedTo":"file:///workspace/node_modules/vm2/index.js","failure":null}],"sessions":[{"probeId":"04c8c4d4-1357-4b05-9782-e0395856faed","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":324.9966930000228}]},{"runId":"c4cd6beb-83d5-4fe8-bb78-d545b7550079","profileId":"bun_1_4_2","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":471.8389599999646,"failure":null,"entries":[{"index":0,"specifier":"vm2","displaySpecifier":"vm2","outcome":"pass","durationMs":39.679632,"resolvedTo":"/workspace/node_modules/vm2/index.js","failure":null}],"sessions":[{"probeId":"25850023-06ec-497a-8161-f6756a079e69","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":471.8389599999646}]},{"runId":"c5f9e346-c3da-4c8e-8dde-91d37c3e19f0","profileId":"bun_1_4_2","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"8f0cca6b-73b3-4b45-b73d-1dec2ba04207","profileId":"bun_1_4_2","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"db3d9641-81b4-477f-b6be-db92854b6806","profileId":"deno_2_9_7","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":438.88402399996994,"failure":null,"entries":[{"index":0,"specifier":"vm2","displaySpecifier":"vm2","outcome":"pass","durationMs":75.75227700000002,"resolvedTo":"file:///workspace/node_modules/vm2/index.js","failure":null}],"sessions":[{"probeId":"b0781afc-57fe-4a0f-b23a-a6c375d80caf","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":438.88402399996994}]},{"runId":"b4de095f-589b-439f-b73d-3812b16e3abf","profileId":"deno_2_9_7","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":448.85035100003006,"failure":null,"entries":[{"index":0,"specifier":"vm2","displaySpecifier":"vm2","outcome":"pass","durationMs":30.68987,"resolvedTo":"/workspace/node_modules/vm2/index.js","failure":null}],"sessions":[{"probeId":"11898877-b92b-47b8-b0a0-709d2e15e8cd","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":448.85035100003006}]},{"runId":"8f8a7097-3c68-431a-a202-b2be1af6fd1e","profileId":"deno_2_9_7","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"31e427c8-29c3-4598-8a4b-b12f2aa337c0","profileId":"deno_2_9_7","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]}],"limitations":["Only installation and loading were observed; functional correctness and package safety are not established.","Subpath batches share module caches and globals; root modes use separate fresh sandboxes.","Package-visible harness observations can be tampered with. They are not adversarial attestation.","Evidence applies to these exact artifacts, dependency snapshot, runtime images and Linux amd64/glibc policy.","Runtime error codes are captured observations and can also be thrown by package code."]}}