badBANANA Threat Observatory v1.2.2 Seeks Independent Reproducibility Verification

The badBANANA Threat Observatory v1.2.2 passes all 108 automated tests in its own development and CI environments, but the maintainer acknowledges this only proves internal consistency, not independent reproducibility. The project handles threat-intelligence data where silent failures — such as expired cache presented as current or offline sources normalized as successful — are considered more dangerous than outright crashes. Version 1.2.2 is designed to fail closed under invalid or stale conditions, with specific required behaviors defined for expiry errors, source outages, and missing data. The maintainer has publicly shared a pinned commit (2b80949fa500515554880ddebf20a2126d42836f) and step-by-step instructions for anyone to clone and test the release in a clean environment running Node.js 22.13.0 or newer. The goal is to confirm that the release builds and all 108 tests pass outside the original development environment, with contributors asked to report their OS, Node/npm versions, and any deviations from expected results.