{
  "title": "Synthetic supply-chain lab",
  "kind": "lab",
  "provenance": "Generated by the BreachLine browser-only lockfile comparison engine from the accompanying synthetic npm lockfiles. No packages downloaded or executed. No live target contacted.",
  "limitations": "Compares npm lockfile metadata by installation path. An integrity change is a review signal, not evidence of compromise. Yarn, pnpm, and npm v1 lockfiles are not supported.",
  "result": {
    "summary": "1 added, 0 removed, and 1 changed package paths.",
    "metrics": [
      {
        "label": "Added",
        "value": 1
      },
      {
        "label": "Removed",
        "value": 0
      },
      {
        "label": "Changed",
        "value": 1
      }
    ],
    "findings": [
      {
        "level": "review",
        "title": "Install lifecycle added",
        "detail": "node_modules/example-ui now records an install hook. Review the package's lifecycle script before installation."
      },
      {
        "level": "review",
        "title": "Missing archive integrity",
        "detail": "node_modules/example-helper has no recorded integrity. Confirm how this package is resolved and regenerate the lockfile with your expected registry. This alone does not establish tampering."
      },
      {
        "level": "info",
        "title": "Metadata comparison",
        "detail": "Entries are matched by installation path, preserving nested copies of the same package. This compares version, resolved source, integrity, link status and install-hook metadata. It does not fetch artifacts or verify their contents."
      }
    ],
    "table": {
      "columns": [
        "Package path",
        "Before version",
        "After version",
        "Change",
        "Changed fields"
      ],
      "rows": [
        [
          "node_modules/example-ui",
          "1.0.0",
          "1.1.0",
          "Changed",
          "Version; Resolved source; Integrity; Install hook: not recorded to yes"
        ],
        [
          "node_modules/example-helper",
          "Absent",
          "2.0.0",
          "Added",
          "Missing archive integrity"
        ]
      ]
    }
  },
  "baselineComparison": {
    "summary": "0 added, 0 removed, and 0 changed package paths.",
    "metrics": [
      {
        "label": "Added",
        "value": 0
      },
      {
        "label": "Removed",
        "value": 0
      },
      {
        "label": "Changed",
        "value": 0
      }
    ],
    "findings": [
      {
        "level": "info",
        "title": "Metadata comparison",
        "detail": "Entries are matched by installation path, preserving nested copies of the same package. This compares version, resolved source, integrity, link status and install-hook metadata. It does not fetch artifacts or verify their contents."
      },
      {
        "level": "info",
        "title": "No tracked metadata changes",
        "detail": "The compared fields match. Other lockfile metadata and package contents can still differ."
      }
    ],
    "table": {
      "columns": [
        "Package path",
        "Before version",
        "After version",
        "Change",
        "Changed fields"
      ],
      "rows": []
    }
  },
  "afterDependencyReview": {
    "summary": "Reviewed 2 package entries from npm lockfile v3.",
    "metrics": [
      {
        "label": "Dependencies",
        "value": 2
      },
      {
        "label": "Missing integrity",
        "value": 1
      },
      {
        "label": "Install hooks",
        "value": 1
      }
    ],
    "findings": [
      {
        "level": "review",
        "title": "Install lifecycle recorded",
        "detail": "node_modules/example-ui has hasInstallScript=true. Review its install hooks and build requirements before installation; the lockfile does not contain the script source."
      },
      {
        "level": "review",
        "title": "Custom or nonregistry source",
        "detail": "node_modules/example-ui uses https://packages.example.com/[path omitted]. Confirm this is the intended registry or repository; custom sources can be legitimate."
      },
      {
        "level": "review",
        "title": "Missing archive integrity",
        "detail": "node_modules/example-helper has no recorded integrity. Confirm how this package is resolved and regenerate the lockfile with your expected registry. This alone does not establish tampering."
      },
      {
        "level": "info",
        "title": "Static metadata review",
        "detail": "No packages are fetched or executed. Integrity fields are reported, not verified against package bytes. This is not a CVE, malware, or provenance scan."
      }
    ],
    "table": {
      "columns": [
        "Package path",
        "Version",
        "Source",
        "Integrity",
        "Install hook"
      ],
      "rows": [
        [
          "node_modules/example-ui",
          "1.1.0",
          "https://packages.example.com/[path omitted]",
          "Recorded, not verified",
          "Yes"
        ],
        [
          "node_modules/example-helper",
          "2.0.0",
          "https://registry.npmjs.org/[path omitted]",
          "Not recorded",
          "Not recorded"
        ]
      ]
    }
  },
  "configurationReview": {
    "provenance": "Synthetic catalog npmrc example with an unresolved NPM_TOKEN placeholder. Reviewed as text only; no environment variable lookup or registry contact.",
    "limitations": "Reviews this file only. Environment variables, user configuration, command-line overrides, and npm version can change effective behavior. Credential values are omitted from results.",
    "beforeFixture": "before.npmrc",
    "afterFixture": "after.npmrc",
    "changes": [
      "@company registry: HTTP to HTTPS",
      "strict-ssl: false to true",
      "ignore-scripts: false to true"
    ],
    "before": {
      "summary": "Reviewed 5 configuration entries. Credential and unknown setting values are omitted.",
      "metrics": [
        {
          "label": "Settings",
          "value": 5
        },
        {
          "label": "Registry mappings",
          "value": 2
        },
        {
          "label": "Auth entries",
          "value": 1
        },
        {
          "label": "Unscoped auth",
          "value": 0
        }
      ],
      "findings": [
        {
          "level": "attention",
          "title": "Unencrypted HTTP registry",
          "detail": "The registry on line 2 uses HTTP. Use HTTPS to protect registry traffic."
        },
        {
          "level": "attention",
          "title": "TLS certificate verification disabled",
          "detail": "strict-ssl=false disables certificate verification for registry requests. Restore verification and configure the correct trusted CA for private registries."
        },
        {
          "level": "info",
          "title": "One file, not the effective npm configuration",
          "detail": "Environment variables, command-line flags and other project/user/global files can override these settings. Duplicate keys use the last value in this input. No environment placeholders are resolved and credential values are never displayed."
        },
        {
          "level": "info",
          "title": "Authentication entries detected",
          "detail": "1 credential or authentication-related entries found. Keep real tokens out of shared configuration and use your secret manager or environment substitution."
        },
        {
          "level": "info",
          "title": "ignore-scripts=false",
          "detail": "Package lifecycle scripts are allowed by this setting. Review package hooks or use an isolated install workflow where appropriate."
        }
      ],
      "table": {
        "columns": [
          "Setting or namespace",
          "Inspected value",
          "Location"
        ],
        "rows": [
          [
            "Default registry",
            "https://registry.npmjs.org",
            "Line 1"
          ],
          [
            "@company",
            "http://packages.example.com",
            "Line 2"
          ],
          [
            "strict-ssl",
            "false",
            "Line 3"
          ],
          [
            "ignore-scripts",
            "false",
            "Line 5"
          ]
        ]
      }
    },
    "after": {
      "summary": "Reviewed 5 configuration entries. Credential and unknown setting values are omitted.",
      "metrics": [
        {
          "label": "Settings",
          "value": 5
        },
        {
          "label": "Registry mappings",
          "value": 2
        },
        {
          "label": "Auth entries",
          "value": 1
        },
        {
          "label": "Unscoped auth",
          "value": 0
        }
      ],
      "findings": [
        {
          "level": "info",
          "title": "One file, not the effective npm configuration",
          "detail": "Environment variables, command-line flags and other project/user/global files can override these settings. Duplicate keys use the last value in this input. No environment placeholders are resolved and credential values are never displayed."
        },
        {
          "level": "info",
          "title": "Authentication entries detected",
          "detail": "1 credential or authentication-related entries found. Keep real tokens out of shared configuration and use your secret manager or environment substitution."
        },
        {
          "level": "info",
          "title": "ignore-scripts=true",
          "detail": "Package lifecycle scripts are disabled by this setting. Explicit script commands can still execute, and some packages require reviewed build steps."
        }
      ],
      "table": {
        "columns": [
          "Setting or namespace",
          "Inspected value",
          "Location"
        ],
        "rows": [
          [
            "Default registry",
            "https://registry.npmjs.org",
            "Line 1"
          ],
          [
            "@company",
            "https://packages.example.com",
            "Line 2"
          ],
          [
            "strict-ssl",
            "true",
            "Line 3"
          ],
          [
            "ignore-scripts",
            "true",
            "Line 5"
          ]
        ]
      }
    }
  },
  "verification": {
    "date": "2026-09-16",
    "method": "Executed deterministic tool functions against the accompanying synthetic fixtures.",
    "limitations": "No package downloaded, installed, or executed. No target contacted. No captured autonomous Nebula run. Lockfile integrity values are illustrative placeholders, not valid artifact checksums. Zero attention findings after the npmrc edit does not verify an endpoint or the effective build configuration."
  }
}