{ "kind": "securefix-operator-rehearsal", "stage": "Phase 1 alpha / pilot candidate", "disclaimer": "Public OSS fixtures · operator-run · not a paying-client delivery · not third-party attestation · not a compliance certificate", "recorded": "2026-08-14", "language_note": "JavaScript (not Java) for the JS batch", "rows": [ { "id": "NodeGoat", "status": "failed", "score": "high_risk", "mode_req": "standard", "mode_eff": "standard-fail-fast", "term": "npm-audit", "n": 50, "sev": { "critical": 16, "high": 24, "medium": 4, "low": 6 }, "by_tool": { "NPMAUDIT": 50 }, "completed": [ "deps", "test", "npm-audit" ], "skipped": [ { "stage": "eslint", "reason": "eslint config missing or incompatible with ESLint 9 flat-config (add eslint.config.* or legacy .eslintrc)" }, { "stage": "tsc", "reason": "no tsconfig.json" }, { "stage": "run", "reason": "earlier stage failed" } ], "summary": "50 finding(s) (high: 40, medium: 4, low: 6)", "duration": 35.4955975, "top_ids": [ "NPMAUDIT-HELMET×1", "NPMAUDIT-HELMET-CSP×1", "NPMAUDIT-MINIMIST×1", "NPMAUDIT-DEBUG×1", "NPMAUDIT-ON-HEADERS×1", "NPMAUDIT-TAR×1", "NPMAUDIT-SEND×1", "NPMAUDIT-ANYMATCH×1", "NPMAUDIT-UNDERSCORE×1", "NPMAUDIT-SET-VALUE×1", "NPMAUDIT-CSURF×1", "NPMAUDIT-QS×1" ], "exits": { "deps": 0, "eslint": 0, "npm-audit": 1, "test": 0, "tsc": 0 }, "product": "2.0.0-pilot-candidate", "has_manifest": true, "note": "", "audited_at": "2026-08-14T09:51:13Z" }, { "id": "dvna", "status": "failed", "score": "high_risk", "mode_req": "standard", "mode_eff": "standard-fail-fast", "term": "npm-audit", "n": 24, "sev": { "critical": 10, "high": 8, "medium": 4, "low": 2 }, "by_tool": { "NPMAUDIT": 24 }, "completed": [ "deps", "npm-audit" ], "skipped": [ { "stage": "eslint", "reason": "eslint config missing or incompatible with ESLint 9 flat-config (add eslint.config.* or legacy .eslintrc)" }, { "stage": "tsc", "reason": "no tsconfig.json" }, { "stage": "test", "reason": "no package.json scripts.test" }, { "stage": "run", "reason": "earlier stage failed" } ], "summary": "24 finding(s) (high: 18, medium: 4, low: 2)", "duration": 4.6707695000000005, "top_ids": [ "NPMAUDIT-TYPED-FUNCTION×1", "NPMAUDIT-BUSBOY×1", "NPMAUDIT-TOUGH-COOKIE×1", "NPMAUDIT-SEQUELIZE×1", "NPMAUDIT-CSURF×1", "NPMAUDIT-NODE-SERIALIZE×1", "NPMAUDIT-FORM-DATA×1", "NPMAUDIT-UUID×1", "NPMAUDIT-MYSQL2×1", "NPMAUDIT-MATHJS×1", "NPMAUDIT-REQUEST×1", "NPMAUDIT-TAR-PACK×1" ], "exits": { "deps": 0, "eslint": 0, "npm-audit": 1, "test": 0, "tsc": 0 }, "product": "2.0.0-pilot-candidate", "has_manifest": true, "note": "", "audited_at": "2026-08-14T09:45:58Z" }, { "id": "nodejs-goof", "status": "failed", "score": "high_risk", "mode_req": "standard", "mode_eff": "standard-fail-fast", "term": "test", "n": 96, "sev": { "critical": 28, "high": 47, "medium": 17, "low": 4 }, "by_tool": { "NPMAUDIT": 95, "TEST": 1 }, "completed": [ "deps", "test", "npm-audit" ], "skipped": [ { "stage": "eslint", "reason": "eslint config missing or incompatible with ESLint 9 flat-config (add eslint.config.* or legacy .eslintrc)" }, { "stage": "tsc", "reason": "no tsconfig.json" }, { "stage": "run", "reason": "earlier stage failed" } ], "summary": "96 finding(s) (high: 75, medium: 17, low: 4)", "duration": 40.6003004, "top_ids": [ "NPMAUDIT-NPMCONF×1", "NPMAUDIT-BRACES×1", "NPMAUDIT-JSPRIM×1", "NPMAUDIT-INI×1", "NPMAUDIT-BRACE-EXPANSION×1", "NPMAUDIT-Y18N×1", "NPMAUDIT-SPAWN-WRAP×1", "NPMAUDIT-MEM×1", "NPMAUDIT-KERBEROS×1", "NPMAUDIT-NEGOTIATOR×1", "NPMAUDIT-SERVE-STATIC×1", "NPMAUDIT-MORGAN×1" ], "exits": { "deps": 0, "eslint": 0, "npm-audit": 1, "test": 2, "tsc": 0 }, "product": "2.0.0-pilot-candidate", "has_manifest": true, "note": "", "audited_at": "2026-08-14T09:54:03Z" }, { "id": "juice-shop", "status": "failed", "score": "high_risk", "mode_req": "standard", "mode_eff": "standard-fail-fast", "term": "test", "n": 40, "sev": { "critical": 7, "high": 18, "medium": 12, "low": 3 }, "by_tool": { "NPMAUDIT": 39, "TEST": 1 }, "completed": [ "deps", "eslint", "test", "npm-audit" ], "skipped": [ { "stage": "run", "reason": "earlier stage failed" } ], "summary": "40 finding(s) (high: 25, medium: 12, low: 3)", "duration": 94.8300062, "top_ids": [ "NPMAUDIT-UUID×1", "NPMAUDIT-_AI-SDK_GATEWAY×1", "NPMAUDIT-AI×1", "NPMAUDIT-REPLACE×1", "NPMAUDIT-SOCKET_IO×1", "NPMAUDIT-CRYPTO-JS×1", "NPMAUDIT-JSONWEBTOKEN×1", "NPMAUDIT-BASE64URL×1", "NPMAUDIT-ENGINE_IO×1", "TEST×1", "NPMAUDIT-UNDICI×1", "NPMAUDIT-_TOOTALLNATE_ONCE×1" ], "exits": { "deps": 0, "eslint": 0, "npm-audit": 1, "test": 1, "tsc": 0 }, "product": "2.0.0-pilot-candidate", "has_manifest": true, "note": "", "audited_at": "2026-08-14T09:49:30Z" }, { "id": "vulnerable-node", "status": "failed", "score": "high_risk", "mode_req": "standard", "mode_eff": "standard-fail-fast", "term": "npm-audit", "n": 24, "sev": { "critical": 5, "high": 14, "medium": 1, "low": 4 }, "by_tool": { "NPMAUDIT": 24 }, "completed": [ "deps", "npm-audit" ], "skipped": [ { "stage": "eslint", "reason": "eslint config missing or incompatible with ESLint 9 flat-config (add eslint.config.* or legacy .eslintrc)" }, { "stage": "tsc", "reason": "no tsconfig.json" }, { "stage": "test", "reason": "no package.json scripts.test" }, { "stage": "run", "reason": "earlier stage failed" } ], "summary": "24 finding(s) (high: 19, medium: 1, low: 4)", "duration": 4.7979502, "top_ids": [ "NPMAUDIT-PG×1", "NPMAUDIT-SEND×1", "NPMAUDIT-MS×1", "NPMAUDIT-COOKIE-PARSER×1", "NPMAUDIT-MIME×1", "NPMAUDIT-LOG4JS×1", "NPMAUDIT-NEGOTIATOR×1", "NPMAUDIT-BODY-PARSER×1", "NPMAUDIT-SERVE-STATIC×1", "NPMAUDIT-DEBUG×1", "NPMAUDIT-SEMVER×1", "NPMAUDIT-FINALHANDLER×1" ], "exits": { "deps": 0, "eslint": 0, "npm-audit": 1, "test": 0, "tsc": 0 }, "product": "2.0.0-pilot-candidate", "has_manifest": true, "note": "", "audited_at": "2026-08-14T09:58:53Z" }, { "id": "Damn-Vulnerable-GraphQL-Application", "status": "NO_RESULT", "score": "", "mode_req": "", "mode_eff": "", "term": "", "n": 0, "sev": null, "by_tool": null, "completed": null, "skipped": null, "summary": "", "duration": 0, "top_ids": null, "exits": null, "product": "", "has_manifest": true, "note": "manifest only; no package.json (GraphQL fixture)" }, { "id": "retire.js", "status": "passed", "score": "low_risk", "mode_req": "standard", "mode_eff": "standard", "term": "", "n": 0, "sev": { }, "by_tool": { }, "completed": [ "deps", "eslint", "npm-audit", "run" ], "skipped": [ { "stage": "test", "reason": "scripts.test uses Unix ENV=value syntax (not valid in cmd.exe / npm on Windows)" } ], "summary": "All audit stages passed", "duration": 8.5929958, "top_ids": [ ], "exits": { "deps": 0, "eslint": 0, "npm-audit": 0, "run": 0, "test": 0, "tsc": 0 }, "product": "2.0.0-pilot-candidate", "has_manifest": true, "note": "", "audited_at": "2026-08-14T09:28:28Z" }, { "id": "express", "status": "passed", "score": "low_risk", "mode_req": "standard", "mode_eff": "standard", "term": "", "n": 0, "sev": { }, "by_tool": { }, "completed": [ "deps", "eslint", "test", "npm-audit", "run" ], "skipped": [ { "stage": "tsc", "reason": "no tsconfig.json" } ], "summary": "All audit stages passed", "duration": 28.7772723, "top_ids": [ ], "exits": { "deps": 0, "eslint": 0, "npm-audit": 0, "run": 0, "test": 0, "tsc": 0 }, "product": "2.0.0-pilot-candidate", "has_manifest": true, "note": "", "audited_at": "2026-08-14T09:46:52Z" }, { "id": "axios", "status": "failed", "score": "medium_risk", "mode_req": "standard", "mode_eff": "standard", "term": "", "n": 40, "sev": { "medium": 40 }, "by_tool": { "TSC": 40 }, "completed": [ "deps", "eslint", "tsc", "npm-audit", "run" ], "skipped": [ { "stage": "test", "reason": "test tooling not on PATH: http.test.js:\u001b[2m4216:25\u001b[22m\u001b[39m\n \u001b[90m4214|\u001b[39m const image = path.resolve(adaptersTestsDir," } ], "summary": "40 finding(s) (high: 0, medium: 40, low: 0)", "duration": 98.173776899999993, "top_ids": [ "TSC-TS2578×16", "TSC-TS7006×14", "TSC-TS18046×5", "TSC-TS2307×5" ], "exits": { "deps": 0, "eslint": 0, "npm-audit": 0, "run": 0, "test": 0, "tsc": 1 }, "product": "2.0.0-pilot-candidate", "has_manifest": true, "note": "", "audited_at": "2026-08-14T09:45:14Z" }, { "id": "lodash", "status": "passed", "score": "low_risk", "mode_req": "standard", "mode_eff": "standard", "term": "", "n": 0, "sev": { }, "by_tool": { }, "completed": [ "deps", "test", "npm-audit", "run" ], "skipped": [ { "stage": "eslint", "reason": "eslint config missing or incompatible with ESLint 9 flat-config (add eslint.config.* or legacy .eslintrc)" }, { "stage": "tsc", "reason": "no tsconfig.json" } ], "summary": "All audit stages passed", "duration": 28.2971567, "top_ids": [ ], "exits": { "deps": 0, "eslint": 0, "npm-audit": 0, "run": 0, "test": 0, "tsc": 0 }, "product": "2.0.0-pilot-candidate", "has_manifest": true, "note": "", "audited_at": "2026-08-14T09:27:56Z" } ] }