npm Lockfile With Integrity Mismatch — Intentionally Invalid
An intentionally invalid npm lockfile: two fictional packages carry sha512 integrity strings that cannot match their resolved tarballs — one derived from the wrong version, one a padded placeholder. Every package, version, hash and licence is fictional — the tree describes nothing real.
{
"name": "orchard-gateway",
"version": "4.2.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "orchard-gateway",
"version": "4.2.0",
"license": "Apache-2.0",
"dependencies": {
"@orchard-example/router": "^2.1.0",
"@orchard-example/http-core": "^1.8.0",
"example-metrics": "^4.0.0",
"example-cache": "^0.9.0",
"example-crypto-shim": "^1.2.0"
},
"engines": {
"node": ">=20.9"
}
},
"node_modules/@orchard-example/router": {
"version": "2.1.3",
"resolved": "https://registry.orchard.example/@orchard-example/router/-/router-2.1.3.tgz",
"integrity": "sha512-qtnM4l9j8zUuqQ9ICsxCdfl879PtducHYPiqO151qEu6bBv48+zuYbTbn/vSTJGbCd2RvGpDry/NEkSe1babaA==",
"license": "Apache-2.0",
"dependencies": {
"example-logger": "^3.4.0",
"example-retry": "^1.0.0"
}
},
"node_modules/@orchard-example/http-core": {
"version": "1.8.0",
"resolved": "https://registry.orchard.example/@orchard-example/http-core/-/http-core-1.8.0.tgz",
"integrity": "sha512-fG9AJmG+37+sln/eMVPmbu/bIcV+QbJ3bibSV9ob8PV6GYNFinrhSJQYFxkEYEHxckXBn7ExDim59rqSDaYoFg==",
"license": "MIT",
"dependencies": {
"example-logger": "^3.4.0",
"example-json-path": "^2.0.0"
}
},
"node_modules/example-metrics": {
"version": "4.0.0",
"resolved": "https://registry.orchard.example/example-metrics/-/example-metrics-4.0.0.tgz",
"integrity": "sha512-Sq3cxZ+Brv4bgLd+5B/o3upQ1O6YKjbr6TP5ZBZfw4XVjna6/8YkOeB52iLhrRDjs1UiF5v20Ijr7bEJtHKcOQ==",
"license": "MIT",
"dependencies": {
"example-logger": "^3.4.0"
}
},Specifications
- Seed
- 51200
- Sample Only
- true
- Ecosystem
- npm
- Lockfile Version
- 3
- Bad Integrity Entries
- 2
- Intentionally Invalid
- true
- Line Endings
- LF
Testing contract
Expected to fail- Scenario
- Verify lockfile integrity hashes before installing.
- Expected result
- Checker flags exactly two entries (example-logger, example-cache) as integrity failures and leaves the other seven untouched.
What is a .json file?
JSON (JavaScript Object Notation) is a lightweight, text-based data-interchange format representing objects, arrays, strings, numbers, booleans, and null. It is language-independent, human-readable, and the dominant format for web APIs and configuration. It requires a single well-formed root value.
How to use this file
Use an example JSON file to test parsers and serializers, schema validation, Unicode and number-precision handling, and API request or response processing.
How to use this file for testing
“npm Lockfile With Integrity Mismatch — Intentionally Invalid” is a deterministic Novus Examples fixture for Error handling, JSON parsing, Schema validation. Deliberately corrupt and invalid files, clearly labelled, for testing how your tool fails.
Documented properties for this file: seed 51200 · LF. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Code examples
import json
with open("package-lock-integrity-mismatch.json") as f:
data = json.load(f)
print(type(data), len(data))Related files
- jsonCycloneDX 1.6 Minimal SBOM (One Component)The smallest CycloneDX document that is still valid: required metadata, one fictional component, and no dependencies array — for testing that a reader handles an SBOM with nothing optional present. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonCycloneDX SBOM With Schema Violations — Intentionally InvalidAn intentionally invalid CycloneDX SBOM: the JSON parses, but bomFormat is missing, one component has no name, and a dependency references a bom-ref that no component declares. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonOSV Record With Schema Violations — Intentionally InvalidAn intentionally invalid OSV record: the JSON parses, but the required id is missing, modified is not an RFC 3339 timestamp, the SEMVER range has a fixed event with no introduced event, and severity.score is a number where the schema demands a CVSS vector string. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
- jsonRekor Transparency-Log EntryA transparency-log entry keyed by its own UUID at the top level — a shape that breaks parsers expecting a fixed root key — with a base64 body that decodes to a dsse record. Signatures, key ids and certificates here are SAMPLE placeholders — the base64 decodes to the words 'SAMPLE SIGNATURE', so verification must fail. Nothing here is cryptographically valid and no key material is real.
- jsonTrivy Clean Scan Report (Zero Findings)A clean scan report — the case dashboards get wrong. Trivy omits the Vulnerabilities key entirely rather than emitting an empty array, so a reader that assumes the key exists throws on a passing build. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
- jsonTrivy Container Image Scan Report (JSON)A Trivy-shaped image report with three result blocks — OS packages, language packages and a Dockerfile misconfiguration — so a parser must handle a Results array whose members have different keys. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
Generated by generation/supply_chain.py. Free for any use, no attribution required — license.