Search files, editable visual templates, and live browser targets from one registry-backed directory. Filtered query views stay crawlable for links but are deliberately noindex; the stable taxonomy pages below remain the canonical search surfaces.
Page 3 of 5; 24 results per page.
An unsigned in-toto Statement carrying a SLSA v1 provenance predicate for a fictional release: build definition, external parameters, resolved dependencies with digests, and run details naming an invented builder. Every package, version, hash and licence is fictional — the tree describes nothing real.
Declared range against resolved version for every fictional package pinned by the lockfiles in this category — the table a review needs to see which pins drifted from their manifest ranges. Every package, version, hash and licence is fictional — the tree describes nothing real.
Maven's dependency tree, complete with the [INFO] log prefix that has to be stripped before the tree can be read and the five-part coordinate form Maven uses. Every package, version, hash and licence is fictional — the tree describes nothing real.
An Elixir mix.lock: a literal Elixir map whose values are tuples of atoms, strings and lists. It is neither JSON nor TOML, so a generic lockfile reader has to special-case it. Every package, version, hash and licence is fictional — the tree describes nothing real.
An npm audit v2 report keyed by package name, with the via chain, the effects list showing which fictional parents are impacted, and npm's own severity vocabulary where MEDIUM is spelled 'moderate'. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
The legacy npm audit shape — numeric advisory ids, a separate actions array and dependency paths written with '>' — which tools built for the v2 report silently read as zero findings. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
An npm lockfile where the fictional example-cache pins a peer of example-logger@2.9.0 while the rest of the tree resolves 3.4.1, forcing a nested node_modules duplicate — the shape a deduplication report must detect. Every package, version, hash and licence is fictional — the tree describes nothing real.
An intentionally invalid npm lockfile: two fictional packages carry sha512 integrity strings that cannot match their resolved tarballs — one derived from the wrong version, one a padded placeholder. Every package, version, hash and licence is fictional — the tree describes nothing real.
The nested tree `npm ls --json` prints, where a shared dependency is REPEATED under every parent rather than deduplicated — so counting objects gives a larger number than the graph has nodes. Every package, version, hash and licence is fictional — the tree describes nothing real.
The console tree with box-drawing characters and `deduped` markers on repeat visits — the output people paste into issues, and a genuine test of whether a scraper handles non-ASCII tree glyphs. Every package, version, hash and licence is fictional — the tree describes nothing real.
The original npm v1 lockfile layout — a nested dependencies object with requires maps and no packages section — still found in long-lived repositories and needed by any migration path. Every package, version, hash and licence is fictional — the tree describes nothing real.
The transitional npm v2 lockfile, which carries BOTH the v3 packages map and the legacy nested dependencies tree describing the same fictional install — the case where a parser must not double-count. Every package, version, hash and licence is fictional — the tree describes nothing real.
An npm lockfile in the modern v3 layout: a flat packages map keyed by node_modules path, with resolved tarball URLs and sha512 subresource integrity for nine fictional dependencies. Every package, version, hash and licence is fictional — the tree describes nothing real.
The shrinkwrap variant of an npm lockfile — identical in structure to package-lock.json but published inside the package tarball, so tooling that keys on the filename must handle both. Every package, version, hash and licence is fictional — the tree describes nothing real.
An OpenVEX document covering all four status values, with the justification and impact statement OpenVEX requires alongside not_affected and the action statement it requires alongside affected. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
An intentionally invalid OSV record: the JSON parses, but the required id is missing, modified is not an RFC 3339 timestamp, the SEMVER range has a fixed event with no introduced event, and severity.score is a number where the schema demands a CVSS vector string. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
A single OSV-schema advisory record for a fictional package, with a SEMVER range expressed as introduced/fixed events rather than as a version string — the part naive parsers get wrong. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
All four SAMPLE advisories as newline-delimited OSV records — the bulk shape an advisory database is loaded from, where each line must parse independently. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
An OSV-Scanner report that nests full OSV records under each affected package and adds the groups array that collapses aliases into one finding — the structure de-duplication depends on. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
A Dependency-Check-shaped JSON report, including the evidence-collection block that records how a package was identified and the confidence attached to that identification. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
The XML twin of the Dependency-Check report — the form most Maven and Jenkins integrations consume — carrying the same four SAMPLE findings inside a namespaced analysis element. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
A NuGet lockfile keyed by target framework, distinguishing Direct from Transitive entries and recording a base64 contentHash for each fictional package. Every package, version, hash and licence is fictional — the tree describes nothing real.
A pip constraints file pinning the same nine fictional packages. Constraints bound a resolution without adding dependencies, so a tool that treats this like requirements.txt installs nine packages too many. Every package, version, hash and licence is fictional — the tree describes nothing real.
A hash-pinned pip requirements file with two sha256 hashes per fictional package (wheel and sdist) and line continuations — the form `--require-hashes` installs demand. Every package, version, hash and licence is fictional — the tree describes nothing real.
We use Google Analytics and show ads via Adsterra. Non-essential cookies and ad scripts run only after you allow the matching categories. See our cookie policy.
