easy-dep-graph 1.1.3 → 1.2.0

package/bin/index.js

@@ -1,36 +1,291 @@
 #! /usr/bin/env node
-import shell from "shelljs";
-import mustache from "mustache";
-import fastify from "fastify";
-import open from "open";
-import fs from "node:fs";
-import path from "node:path";
-import semver from "semver";
+import shell from 'shelljs';
+import mustache from 'mustache';
+import fastify from 'fastify';
+import open from 'open';
+import fs from 'node:fs';
+import path from 'node:path';
+import semver from 'semver';
 let flatDeps;
+// ─── Known Malicious / Compromised Packages Database ────────────────
+const knownMaliciousPackages = [
+    // === Compromised legitimate packages (specific bad versions) ===
+    {
+        name: 'axios',
+        badVersions: ['1.14.1', '0.30.4'],
+        severity: 'critical',
+        description: 'Compromised via maintainer account hijack (Mar 2026). Injected RAT malware via plain-crypto-js dependency.',
+    },
+    {
+        name: 'ua-parser-js',
+        badVersions: ['0.7.29', '0.8.0', '1.0.0'],
+        severity: 'critical',
+        description: 'Compromised via account hijack (Oct 2021). Installed crypto miners and Danabot trojan.',
+    },
+    {
+        name: 'coa',
+        badVersions: ['2.0.3', '2.0.4', '2.1.1', '2.1.3', '3.1.3'],
+        severity: 'critical',
+        description: 'Compromised via account hijack (Nov 2021). Malicious preinstall script downloaded Danabot trojan.',
+    },
+    {
+        name: 'rc',
+        badVersions: ['1.2.9', '1.3.9', '2.3.9'],
+        severity: 'critical',
+        description: 'Compromised via account hijack (Nov 2021). Same Danabot trojan payload as coa.',
+    },
+    {
+        name: 'event-stream',
+        badVersions: ['3.3.6'],
+        severity: 'critical',
+        description: 'Compromised via social-engineered maintainer transfer (Nov 2018). Stole Bitcoin from Copay wallets via flatmap-stream.',
+    },
+    {
+        name: 'colors',
+        badVersions: ['1.4.1', '1.4.44-liberty-2'],
+        severity: 'high',
+        description: 'Sabotaged by maintainer (Jan 2022). Infinite loop printing zalgo text causing DoS. Use 1.4.0 instead.',
+    },
+    {
+        name: 'faker',
+        badVersions: ['6.6.6'],
+        severity: 'high',
+        description: 'Sabotaged by maintainer (Jan 2022). Package contents wiped. Use @faker-js/faker instead.',
+    },
+    {
+        name: 'node-ipc',
+        badVersions: ['10.1.1', '10.1.2', '9.2.2', '11.0.0', '11.1.0'],
+        severity: 'critical',
+        description: 'Protestware (Mar 2022). Geo-targeted file destruction for Russian/Belarusian IPs. CVE-2022-23812.',
+    },
+    {
+        name: 'eslint-scope',
+        badVersions: ['3.7.2'],
+        severity: 'critical',
+        description: 'Compromised (Jul 2018). Stole npm tokens from developer machines.',
+    },
+    // === Always-malicious packages (any version) ===
+    {
+        name: 'flatmap-stream',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Malicious package used in event-stream supply chain attack. Stole cryptocurrency credentials.',
+    },
+    {
+        name: 'plain-crypto-js',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Malicious dependency injected into compromised axios versions. Delivers cross-platform RAT.',
+    },
+    {
+        name: 'peacenotwar',
+        badVersions: '*',
+        severity: 'high',
+        description: 'Protestware dropped by compromised node-ipc. Writes files to user desktop.',
+    },
+    {
+        name: 'getcookies',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Backdoor hidden in express middleware (May 2018). Remote code execution.',
+    },
+    {
+        name: 'crossenv',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of cross-env. Steals environment variables and npm tokens.',
+    },
+    {
+        name: 'event-strem',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of event-stream. Credential theft.',
+    },
+    {
+        name: 'lodahs',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of lodash. Malware dropper.',
+    },
+    {
+        name: 'babelcli',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of babel-cli. Steals environment variables.',
+    },
+    {
+        name: 'd3.js',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of d3. Credential theft.',
+    },
+    {
+        name: 'ffmpegs',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of ffmpeg. Crypto miner.',
+    },
+    {
+        name: 'gruntcli',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of grunt-cli. Steals environment variables.',
+    },
+    {
+        name: 'http-proxy.js',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of http-proxy. Credential theft.',
+    },
+    {
+        name: 'mongose',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of mongoose. Steals environment variables.',
+    },
+    {
+        name: 'node-fabric',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of fabric. Opens remote shell.',
+    },
+    {
+        name: 'node-opencv',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of opencv. Credential theft.',
+    },
+    {
+        name: 'node-opensl',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of openssl. Credential theft.',
+    },
+    {
+        name: 'node-openssl',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of openssl. Credential theft.',
+    },
+    {
+        name: 'nodecaffe',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of node-caffe. Credential theft.',
+    },
+    {
+        name: 'nodefabric',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of node-fabric. Credential theft.',
+    },
+    {
+        name: 'nodemailer-js',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of nodemailer. Credential theft.',
+    },
+    {
+        name: 'noderequest',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of request. Credential theft.',
+    },
+    {
+        name: 'nodesass',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of node-sass. Credential theft.',
+    },
+    {
+        name: 'nodesqlite',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of sqlite. Credential theft.',
+    },
+    {
+        name: 'shadowsock',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of shadowsocks. Credential theft.',
+    },
+    {
+        name: 'sqlite.js',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of sqlite3. Credential theft.',
+    },
+    {
+        name: 'proxy.js',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of proxy. Credential theft.',
+    },
+    {
+        name: 'discorsd.js',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of discord.js. Token stealer.',
+    },
+    {
+        name: 'colored',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of colors. Credential theft.',
+    },
+    {
+        name: 'mariadb',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of mariasql. Credential theft.',
+    },
+    {
+        name: 'electron-native-notify',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Malicious package (Jun 2019). Stole cryptocurrency credentials.',
+    },
+    {
+        name: 'rest-client',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Malicious package (Aug 2019). Injected code to steal credentials.',
+    },
+    {
+        name: 'bootstrap-sass',
+        badVersions: '*',
+        severity: 'high',
+        description: 'Typosquat with crypto miner.',
+    },
+];
 void (async function main() {
     // Check if peer dependencies mode
-    const peerDependenciesMode = process.argv.findIndex((a) => a.toLowerCase() === "--peer-dependencies") !==
-        -1;
+    const peerDependenciesMode = process.argv.findIndex((a) => a.toLowerCase() === '--peer-dependencies') !== -1;
     // List of packages user wants to see the dependencies
-    const packagesArgIndex = process.argv.findIndex((a) => a.toLowerCase() === "--packages");
+    const packagesArgIndex = process.argv.findIndex((a) => a.toLowerCase() === '--packages');
     const packagesFilter = packagesArgIndex !== -1 ? process.argv[packagesArgIndex + 1] : undefined;
     // Only get the dependents of a specific package
-    const packageArgIndex = process.argv.findIndex((a) => a.toLowerCase() === "--package-dependents");
+    const packageArgIndex = process.argv.findIndex((a) => a.toLowerCase() === '--package-dependents');
     const packageName = packageArgIndex !== -1 ? process.argv[packageArgIndex + 1] : undefined;
     // Get port number
-    const portArgIndex = process.argv.findIndex((a) => a.toLowerCase() === "--port");
+    const portArgIndex = process.argv.findIndex((a) => a.toLowerCase() === '--port');
     const port = portArgIndex !== -1 ? +process.argv[portArgIndex + 1] : 8080;
     // Get if should not open browser
-    const shouldOpenBrowser = process.argv.findIndex((a) => a.toLowerCase() === "--no-open") === -1;
+    const shouldOpenBrowser = process.argv.findIndex((a) => a.toLowerCase() === '--no-open') === -1;
     // Get if should not apply force layout
-    const shouldApplyForceLayout = process.argv.findIndex((a) => a.toLowerCase() === "--no-force-layout") ===
-        -1;
+    const shouldApplyForceLayout = process.argv.findIndex((a) => a.toLowerCase() === '--no-force-layout') === -1;
+    // Check if security scan mode
+    const securityScanMode = process.argv.findIndex((a) => a.toLowerCase() === '--security-scan') !== -1;
+    if (securityScanMode) {
+        await runSecurityScanMode(port, shouldOpenBrowser);
+        return;
+    }
     if (peerDependenciesMode) {
         await runPeerDependenciesMode(port, shouldOpenBrowser);
         return;
     }
     // Run npm list command
-    const result = shell.exec(`npm list --json ${packageName ?? "--all"}`, {
+    const result = shell.exec(`npm list --json ${packageName ?? '--all'}`, {
         windowsHide: true,
         silent: true,
     });
@@ -39,7 +294,7 @@ void (async function main() {
     console.log(`Generating dependency graph for: "${packageInfo.name}"...`);
     // Filter dependencies if needed
     if (packagesFilter != null) {
-        const packagesFilterList = packagesFilter.split(",").map((d) => d.trim());
+        const packagesFilterList = packagesFilter.split(',').map((d) => d.trim());
         for (const key of Object.keys(packageInfo.dependencies)) {
             if (!packagesFilterList.includes(key)) {
                 delete packageInfo.dependencies[key];
@@ -75,7 +330,7 @@ void (async function main() {
                 x,
                 y,
                 size: 10,
-                color: dep[1].isRoot ? "#22c55e" : "#3b82f6",
+                color: dep[1].isRoot ? '#22c55e' : '#3b82f6',
             };
         })),
         edges: JSON.stringify(Object.entries(flatDeps)
@@ -91,7 +346,7 @@ void (async function main() {
     const app = fastify({
         logger: false,
     });
-    app.get("/", (_req, resp) => resp.type("text/html").send(html));
+    app.get('/', (_req, resp) => resp.type('text/html').send(html));
     // Run the server
     app.listen({ port }, (err, address) => {
         if (err)
@@ -123,10 +378,10 @@ function flatDepsRecursive(deps, parentDepName) {
     }
 }
 async function runPeerDependenciesMode(port, shouldOpenBrowser) {
-    console.log("Analyzing peer dependencies...");
+    console.log('Analyzing peer dependencies...');
     // Get the current project's package.json
-    const packageJsonPath = path.join(process.cwd(), "package.json");
-    const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"));
+    const packageJsonPath = path.join(process.cwd(), 'package.json');
+    const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
     const installedPackages = {
         ...packageJson.dependencies,
         ...packageJson.devDependencies,
@@ -138,8 +393,8 @@ async function runPeerDependenciesMode(port, shouldOpenBrowser) {
         const resolvedVersion = resolveVersion(info.versions);
         const isInPackageJson = installedPackages[name] !== undefined;
         // Check if installed in node_modules (even if not in package.json)
-        const nodeModulesPath = path.join(process.cwd(), "node_modules");
-        const pkgPath = path.join(nodeModulesPath, name, "package.json");
+        const nodeModulesPath = path.join(process.cwd(), 'node_modules');
+        const pkgPath = path.join(nodeModulesPath, name, 'package.json');
         const existsInNodeModules = fs.existsSync(pkgPath);
         const isInstalledByDependency = existsInNodeModules && !isInPackageJson;
         return {
@@ -163,8 +418,8 @@ async function runPeerDependenciesMode(port, shouldOpenBrowser) {
     const app = fastify({
         logger: false,
     });
-    app.get("/", (_req, resp) => resp.type("text/html").send(html));
-    app.post("/install", async (req, resp) => {
+    app.get('/', (_req, resp) => resp.type('text/html').send(html));
+    app.post('/install', async (req, resp) => {
         const { package: pkg, version } = req.body;
         console.log(`Installing ${pkg}@${version}...`);
         const installResult = shell.exec(`npm install ${pkg}@${version}`, {
@@ -182,7 +437,7 @@ async function runPeerDependenciesMode(port, shouldOpenBrowser) {
             console.error(`Failed to install ${pkg}@${version}`);
             return {
                 success: false,
-                message: installResult.stderr || "Installation failed",
+                message: installResult.stderr || 'Installation failed',
             };
         }
     });
@@ -197,7 +452,7 @@ async function runPeerDependenciesMode(port, shouldOpenBrowser) {
 }
 function collectPeerDependenciesRecursively(initialPackages) {
     const peerDeps = {};
-    const nodeModulesPath = path.join(process.cwd(), "node_modules");
+    const nodeModulesPath = path.join(process.cwd(), 'node_modules');
     const visited = new Set();
     const queue = Object.keys(initialPackages);
     while (queue.length > 0) {
@@ -208,11 +463,11 @@ function collectPeerDependenciesRecursively(initialPackages) {
         }
         visited.add(packageName);
         try {
-            const pkgJsonPath = path.join(nodeModulesPath, packageName, "package.json");
+            const pkgJsonPath = path.join(nodeModulesPath, packageName, 'package.json');
             if (!fs.existsSync(pkgJsonPath)) {
                 continue;
             }
-            const pkgJson = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+            const pkgJson = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8'));
             // Collect peer dependencies
             if (pkgJson.peerDependencies) {
                 for (const [peerDepName, peerDepVersion] of Object.entries(pkgJson.peerDependencies)) {
@@ -254,7 +509,7 @@ function collectPeerDependenciesRecursively(initialPackages) {
 }
 function resolveVersion(versions) {
     if (versions.length === 0) {
-        return { version: "*", isConflict: false };
+        return { version: '*', isConflict: false };
     }
     if (versions.length === 1) {
         return { version: versions[0], isConflict: false };
@@ -286,445 +541,863 @@ function resolveVersion(versions) {
             }
             else {
                 // Ranges don't intersect - conflict detected
-                return { version: uniqueVersions.join(" | "), isConflict: true };
+                return { version: uniqueVersions.join(' | '), isConflict: true };
             }
         }
         return { version: intersection, isConflict: false };
     }
     catch (error) {
         // If semver parsing fails, fall back to showing all versions
-        return { version: uniqueVersions.join(" | "), isConflict: true };
+        return { version: uniqueVersions.join(' | '), isConflict: true };
     }
 }
-function getPeerDepsTemplate() {
-    return `
-<html>
-  <head>
-    <title>{{projectName}} - Peer Dependencies</title>
-    <style>
-      * {
-        margin: 0;
-        padding: 0;
-        box-sizing: border-box;
-      }
-      
-      body {
-        font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
-        background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
-        min-height: 100vh;
-        padding: 2rem;
-      }
-      
-      .container {
-        max-width: 1200px;
-        margin: 0 auto;
-      }
-      
-      h1 {
-        color: white;
-        margin-bottom: 2rem;
-        font-size: 2.5rem;
-        text-align: center;
-        text-shadow: 2px 2px 4px rgba(0,0,0,0.2);
-      }
-      
-      .peer-deps-list {
-        background: white;
-        border-radius: 12px;
-        box-shadow: 0 10px 40px rgba(0,0,0,0.1);
-        overflow: hidden;
-      }
-      
-      .peer-dep-item {
-        padding: 1.5rem;
-        border-bottom: 1px solid #e5e7eb;
-        transition: background-color 0.2s;
-      }
-      
-      .peer-dep-item:last-child {
-        border-bottom: none;
-      }
-      
-      .peer-dep-item:hover {
-        background-color: #f9fafb;
-      }
-      
-      .peer-dep-header {
-        display: flex;
-        justify-content: space-between;
-        align-items: center;
-        margin-bottom: 0.75rem;
-      }
-      
-      .peer-dep-name {
-        font-size: 1.25rem;
-        font-weight: 600;
-        color: #1f2937;
-      }
-      
-      .peer-dep-version {
-        font-family: 'Courier New', monospace;
-        padding: 0.25rem 0.75rem;
-        background: #f3f4f6;
-        border-radius: 6px;
-        font-size: 0.875rem;
-        color: #4b5563;
-      }
-      
-      .peer-dep-version.conflict {
-        background: #fee2e2;
-        color: #dc2626;
-        font-weight: 600;
-      }
-      
-      .peer-dep-info {
-        display: flex;
-        justify-content: space-between;
-        align-items: center;
-        flex-wrap: wrap;
-        gap: 1rem;
-      }
-      
-      .required-by {
-        flex: 1;
-        min-width: 200px;
-      }
-      
-      .required-by-label {
-        font-size: 0.75rem;
-        color: #6b7280;
-        text-transform: uppercase;
-        letter-spacing: 0.05em;
-        margin-bottom: 0.25rem;
-      }
-      
-      .required-by-list {
-        display: flex;
-        flex-wrap: wrap;
-        gap: 0.5rem;
-      }
-      
-      .required-by-tag {
-        display: inline-block;
-        padding: 0.25rem 0.5rem;
-        background: #dbeafe;
-        color: #1e40af;
-        border-radius: 4px;
-        font-size: 0.75rem;
-        font-weight: 500;
-      }
-      
-      .install-btn {
-        padding: 0.5rem 1.5rem;
-        background: #3b82f6;
-        color: white;
-        border: none;
-        border-radius: 6px;
-        font-size: 0.875rem;
-        font-weight: 500;
-        cursor: pointer;
-        transition: all 0.2s;
-        box-shadow: 0 2px 4px rgba(59, 130, 246, 0.3);
-      }
-      
-      .install-btn:hover {
-        background: #2563eb;
-        transform: translateY(-1px);
-        box-shadow: 0 4px 8px rgba(59, 130, 246, 0.4);
-      }
-      
-      .install-btn:active {
-        transform: translateY(0);
-      }
-      
-      .install-btn:disabled {
-        background: #9ca3af;
-        cursor: not-allowed;
-        transform: none;
-        box-shadow: none;
-      }
-      
-      .installed-badge {
-        display: flex;
-        align-items: center;
-        gap: 0.5rem;
-        padding: 0.5rem 1rem;
-        background: #d1fae5;
-        color: #065f46;
-        border-radius: 6px;
-        font-size: 0.875rem;
-        font-weight: 600;
-      }
-      
-      .installed-by-dep-badge {
-        display: flex;
-        align-items: center;
-        gap: 0.5rem;
-        padding: 0.5rem 1rem;
-        background: #e0e7ff;
-        color: #3730a3;
-        border-radius: 6px;
-        font-size: 0.875rem;
-        font-weight: 600;
-      }
-      
-      .checkmark {
-        color: #10b981;
-        font-size: 1.25rem;
-      }
-      
-      .message {
-        margin-top: 0.5rem;
-        padding: 0.5rem;
-        border-radius: 4px;
-        font-size: 0.875rem;
-        display: none;
-      }
-      
-      .message.success {
-        background: #d1fae5;
-        color: #065f46;
-        display: block;
-      }
-      
-      .message.error {
-        background: #fee2e2;
-        color: #dc2626;
-        display: block;
-      }
-
-      .no-deps {
-        padding: 3rem;
-        text-align: center;
-        color: #6b7280;
-        font-size: 1.125rem;
-      }
-    </style>
-  </head>
-  <body>
-    <div class="container">
-      <h1>Peer Dependencies for {{projectName}}</h1>
-      <div class="peer-deps-list">
-        {{#peerDeps}}
-        <div class="peer-dep-item">
-          <div class="peer-dep-header">
-            <span class="peer-dep-name">{{name}}</span>
-            <span class="peer-dep-version {{#isConflict}}conflict{{/isConflict}}">
-              {{#isConflict}}Conflict: {{/isConflict}}{{version}}
-            </span>
-          </div>
-          <div class="peer-dep-info">
-            <div class="required-by">
-              <div class="required-by-label">Required by:</div>
-              <div class="required-by-list">
-                {{#requiredBy}}
-                <span class="required-by-tag">{{.}}</span>
-                {{/requiredBy}}
-              </div>
-            </div>
-            <div class="action-container">
-              {{#isInstalled}}
-              <div class="installed-badge">
-                Installed
-              </div>
-              {{/isInstalled}}
-              {{#isInstalledByDependency}}
-              <div class="installed-by-dep-badge">
-                Installed by dependency
-              </div>
-              {{/isInstalledByDependency}}
-              {{^isInstalled}}
-              {{^isInstalledByDependency}}
-              <button class="install-btn" onclick="installPackage('{{name}}', '{{version}}', this)">
-                npm install
-              </button>
-              <div class="message" id="msg-{{name}}"></div>
-              {{/isInstalledByDependency}}
-              {{/isInstalled}}
-            </div>
-          </div>
-        </div>
-        {{/peerDeps}}
-        {{^peerDeps}}
-        <div class="no-deps">
-          No peer dependencies found!
-        </div>
-        {{/peerDeps}}
-      </div>
-    </div>
-    
-    <script>
-      async function installPackage(packageName, version, button) {
-        const messageEl = document.getElementById('msg-' + packageName);
-        
-        button.disabled = true;
-        button.textContent = 'Installing...';
-        messageEl.className = 'message';
-        messageEl.textContent = '';
-        
-        try {
-          const response = await fetch('/install', {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              package: packageName,
-              version: version
-            })
-          });
-          
-          const result = await response.json();
-          
-          if (result.success) {
-            messageEl.className = 'message success';
-            messageEl.textContent = result.message;
-            button.style.display = 'none';
-            
-            // Optionally reload after a delay
-            setTimeout(() => {
-              location.reload();
-            }, 2000);
-          } else {
-            messageEl.className = 'message error';
-            messageEl.textContent = result.message;
-            button.disabled = false;
-            button.textContent = 'npm install';
-          }
-        } catch (error) {
-          messageEl.className = 'message error';
-          messageEl.textContent = 'Failed to install package: ' + error.message;
-          button.disabled = false;
-          button.textContent = 'npm install';
-        }
-      }
-    </script>
-  </body>
-</html>
-`;
-}
-function getTemplate() {
-    return `
-<html>
-  <head>
-    <title>{{name}}'s Dependency Graph</title>
-    <script src="https://cdnjs.cloudflare.com/ajax/libs/sigma.js/2.4.0/sigma.min.js"></script>
-    <script src="https://cdnjs.cloudflare.com/ajax/libs/graphology/0.25.4/graphology.umd.min.js"></script>
-    <script type="text/javascript">
-        function applyForceLayout(graph, iterations) {
-            var nodes = graph.nodes();
-            var edges = graph.edges();
-            
-            // Physics constants - lower repulsion for better spacing
-            var repulsionStrength = 50;
-            var attractionStrength = 0.01;
-            var damping = 0.5;
-            
-            for (var iter = 0; iter < iterations; iter++) {
-                var forces = {};
-                
-                // Initialize forces
-                nodes.forEach(function(nodeId) {
-                    forces[nodeId] = { x: 0, y: 0 };
-                });
-                
-                // Repulsive forces between all nodes
-                for (var i = 0; i < nodes.length; i++) {
-                    for (var j = i + 1; j < nodes.length; j++) {
-                        var node1 = nodes[i];
-                        var node2 = nodes[j];
-                        var attrs1 = graph.getNodeAttributes(node1);
-                        var attrs2 = graph.getNodeAttributes(node2);
-                        
-                        var dx = attrs2.x - attrs1.x;
-                        var dy = attrs2.y - attrs1.y;
-                        var distance = Math.sqrt(dx * dx + dy * dy) || 0.1;
-                        var force = repulsionStrength / (distance * distance);
-                        
-                        var fx = (dx / distance) * force;
-                        var fy = (dy / distance) * force;
-                        
-                        forces[node1].x -= fx;
-                        forces[node1].y -= fy;
-                        forces[node2].x += fx;
-                        forces[node2].y += fy;
+// ─── Security Scan Logic ────────────────────────────────────────────
+async function runSecurityScanMode(port, shouldOpenBrowser) {
+    console.log('Running security scan...\n');
+    const findings = [];
+    const nodeModulesPath = path.join(process.cwd(), 'node_modules');
+    // Phase 1: Scan node_modules against known malicious packages
+    if (fs.existsSync(nodeModulesPath)) {
+        const entries = fs.readdirSync(nodeModulesPath);
+        for (const entry of entries) {
+            // Handle scoped packages (@scope/name)
+            if (entry.startsWith('@')) {
+                const scopePath = path.join(nodeModulesPath, entry);
+                try {
+                    const scopedEntries = fs.readdirSync(scopePath);
+                    for (const scopedEntry of scopedEntries) {
+                        const fullName = `${entry}/${scopedEntry}`;
+                        checkPackageAgainstDatabase(nodeModulesPath, fullName, findings);
                     }
                 }
-                
-                // Attractive forces along edges
-                edges.forEach(function(edgeId) {
-                    var edge = graph.extremities(edgeId);
-                    var source = edge.source || edge[0];
-                    var target = edge.target || edge[1];
-                    var attrs1 = graph.getNodeAttributes(source);
-                    var attrs2 = graph.getNodeAttributes(target);
-                    
-                    var dx = attrs2.x - attrs1.x;
-                    var dy = attrs2.y - attrs1.y;
-                    var distance = Math.sqrt(dx * dx + dy * dy) || 0.1;
-                    
-                    var fx = dx * attractionStrength;
-                    var fy = dy * attractionStrength;
-                    
-                    forces[source].x += fx;
-                    forces[source].y += fy;
-                    forces[target].x -= fx;
-                    forces[target].y -= fy;
-                });
-                
-                // Apply forces with damping
-                nodes.forEach(function(nodeId) {
-                    var attrs = graph.getNodeAttributes(nodeId);
-                    attrs.x += forces[nodeId].x * damping;
-                    attrs.y += forces[nodeId].y * damping;
-                });
+                catch {
+                    // Skip unreadable scope directories
+                }
+                continue;
             }
+            checkPackageAgainstDatabase(nodeModulesPath, entry, findings);
         }
-    
-        function renderGraph() {
-            var nodes = {{{nodes}}};
-            var edges = {{{edges}}};
-            
-            var graph = new graphology.Graph();
-            
-            nodes.forEach(function(node) {
-                graph.addNode(node.key, {
-                    label: node.label,
-                    x: node.x,
-                    y: node.y,
-                    size: node.size,
-                    color: node.color
-                });
-            });
-            
-            edges.forEach(function(edge, index) {
-                graph.mergeEdge(edge.source, edge.target, {
-                    size: 2,
-                    color: '#94a3b8'
+    }
+    else {
+        console.warn('Warning: node_modules directory not found. Skipping local package scan.\n');
+    }
+    // Phase 2: Run npm audit
+    console.log('Running npm audit...');
+    const auditResult = shell.exec('npm audit --json', {
+        windowsHide: true,
+        silent: true,
+    });
+    if (auditResult.code !== 0 && auditResult.stdout.trim() === '') {
+        console.warn('Warning: npm audit failed (missing package-lock.json or no network). Showing known-malicious results only.\n');
+    }
+    else {
+        try {
+            const auditData = JSON.parse(auditResult.stdout);
+            const vulnerabilities = auditData.vulnerabilities ?? {};
+            for (const [pkgName, vulnInfo] of Object.entries(vulnerabilities)) {
+                // Skip if already flagged by our known-malicious list
+                if (findings.some((f) => f.name === pkgName))
+                    continue;
+                const severity = vulnInfo.severity ?? 'moderate';
+                const via = Array.isArray(vulnInfo.via)
+                    ? vulnInfo.via
+                        .map((v) => (typeof v === 'string' ? v : (v.title ?? v.name ?? '')))
+                        .filter(Boolean)
+                        .join('; ')
+                    : String(vulnInfo.via ?? '');
+                const installedVer = vulnInfo.range ?? vulnInfo.version ?? 'unknown';
+                findings.push({
+                    name: pkgName,
+                    installedVersion: installedVer,
+                    severity: severity,
+                    source: 'npm-audit',
+                    description: via || `Vulnerability reported by npm audit (${severity})`,
                 });
+            }
+        }
+        catch {
+            console.warn('Warning: Could not parse npm audit output.\n');
+        }
+    }
+    // Sort findings: critical first, then high, moderate, low
+    const severityOrder = { critical: 0, high: 1, moderate: 2, low: 3 };
+    findings.sort((a, b) => severityOrder[a.severity] - severityOrder[b.severity]);
+    // Phase 3: Terminal output
+    printSecurityScanResults(findings);
+    // Phase 4: Serve HTML report
+    const packageJsonPath = path.join(process.cwd(), 'package.json');
+    let projectName = 'Unknown Project';
+    try {
+        const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
+        projectName = packageJson.name ?? projectName;
+    }
+    catch {
+        // Ignore
+    }
+    const criticalCount = findings.filter((f) => f.severity === 'critical').length;
+    const highCount = findings.filter((f) => f.severity === 'high').length;
+    const moderateCount = findings.filter((f) => f.severity === 'moderate').length;
+    const lowCount = findings.filter((f) => f.severity === 'low').length;
+    const data = {
+        projectName,
+        findings,
+        totalCount: findings.length,
+        criticalCount,
+        highCount,
+        moderateCount,
+        lowCount,
+        hasCritical: criticalCount > 0,
+        hasHigh: highCount > 0,
+        hasModerate: moderateCount > 0,
+        hasLow: lowCount > 0,
+        hasFindings: findings.length > 0,
+    };
+    const html = mustache.render(getSecurityScanTemplate(), data);
+    const app = fastify({ logger: false });
+    app.get('/', (_req, resp) => resp.type('text/html').send(html));
+    app.listen({ port }, (err, address) => {
+        if (err)
+            throw err;
+        console.log(`\nSecurity report available at: ${address}`);
+        if (shouldOpenBrowser)
+            open(address);
+    });
+}
+function checkPackageAgainstDatabase(nodeModulesPath, packageName, findings) {
+    const pkgJsonPath = path.join(nodeModulesPath, packageName, 'package.json');
+    if (!fs.existsSync(pkgJsonPath))
+        return;
+    let installedVersion;
+    try {
+        const pkgJson = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8'));
+        installedVersion = pkgJson.version ?? '0.0.0';
+    }
+    catch {
+        return;
+    }
+    for (const entry of knownMaliciousPackages) {
+        if (entry.name !== packageName)
+            continue;
+        if (entry.badVersions === '*') {
+            findings.push({
+                name: packageName,
+                installedVersion,
+                severity: entry.severity,
+                source: 'known-malicious',
+                description: entry.description,
             });
-            
-            // Apply custom force-directed layout
-            {{#applyForceLayout}}
-            applyForceLayout(graph, 100);
-            {{/applyForceLayout}}
-            
-            var container = document.getElementById("dep-graph");
-            var renderer = new Sigma(graph, container, {
-                renderEdgeLabels: false,
-                defaultNodeColor: '#3b82f6',
-                defaultEdgeColor: '#94a3b8'
+        }
+        else if (entry.badVersions.includes(installedVersion)) {
+            findings.push({
+                name: packageName,
+                installedVersion,
+                severity: entry.severity,
+                source: 'known-malicious',
+                description: entry.description,
             });
         }
-    </script>
-    <style>
-        body { margin: 0; padding: 0; }
-        #dep-graph { width: 100vw; height: 100vh; background: #f8fafc; }
-    </style>
-  </head>
-  <body onload="renderGraph()">
-    <div id="dep-graph"></div>
-  </body>
-</html>
+    }
+}
+function printSecurityScanResults(findings) {
+    if (findings.length === 0) {
+        console.log('\x1b[32m✔ No known malicious packages or vulnerabilities found.\x1b[0m\n');
+        return;
+    }
+    const critical = findings.filter((f) => f.severity === 'critical');
+    const high = findings.filter((f) => f.severity === 'high');
+    const moderate = findings.filter((f) => f.severity === 'moderate');
+    const low = findings.filter((f) => f.severity === 'low');
+    console.log(`\x1b[1mSecurity Scan Results:\x1b[0m`);
+    console.log(`─────────────────────────────────────────────`);
+    if (critical.length > 0)
+        console.log(`  \x1b[31m● ${critical.length} critical\x1b[0m`);
+    if (high.length > 0)
+        console.log(`  \x1b[33m● ${high.length} high\x1b[0m`);
+    if (moderate.length > 0)
+        console.log(`  \x1b[36m● ${moderate.length} moderate\x1b[0m`);
+    if (low.length > 0)
+        console.log(`  \x1b[37m● ${low.length} low\x1b[0m`);
+    console.log(`─────────────────────────────────────────────\n`);
+    for (const finding of findings) {
+        const color = finding.severity === 'critical'
+            ? '\x1b[31m'
+            : finding.severity === 'high'
+                ? '\x1b[33m'
+                : finding.severity === 'moderate'
+                    ? '\x1b[36m'
+                    : '\x1b[37m';
+        const sourceTag = finding.source === 'known-malicious' ? '[KNOWN MALICIOUS]' : '[npm audit]';
+        console.log(`  ${color}${finding.severity.toUpperCase()}\x1b[0m  ${finding.name}@${finding.installedVersion}  ${sourceTag}`);
+        console.log(`         ${finding.description}`);
+        console.log();
+    }
+}
+// ─── Security Scan HTML Template ────────────────────────────────────
+function getSecurityScanTemplate() {
+    return `
+<html>
+  <head>
+    <title>{{projectName}} - Security Scan</title>
+    <style>
+      * { margin: 0; padding: 0; box-sizing: border-box; }
+
+      body {
+        font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
+        background: linear-gradient(135deg, #1a1a2e 0%, #16213e 50%, #0f3460 100%);
+        min-height: 100vh;
+        padding: 2rem;
+        color: #e2e8f0;
+      }
+
+      .container { max-width: 1200px; margin: 0 auto; }
+
+      h1 {
+        color: white;
+        margin-bottom: 0.5rem;
+        font-size: 2.5rem;
+        text-align: center;
+        text-shadow: 2px 2px 4px rgba(0,0,0,0.3);
+      }
+
+      .subtitle {
+        text-align: center;
+        color: #94a3b8;
+        margin-bottom: 2rem;
+        font-size: 1.1rem;
+      }
+
+      .summary-cards {
+        display: flex;
+        gap: 1rem;
+        margin-bottom: 2rem;
+        flex-wrap: wrap;
+        justify-content: center;
+      }
+
+      .summary-card {
+        padding: 1.25rem 2rem;
+        border-radius: 12px;
+        text-align: center;
+        min-width: 140px;
+        backdrop-filter: blur(10px);
+        border: 1px solid rgba(255,255,255,0.1);
+      }
+
+      .summary-card .count {
+        font-size: 2.5rem;
+        font-weight: 700;
+        line-height: 1;
+      }
+
+      .summary-card .label {
+        font-size: 0.8rem;
+        text-transform: uppercase;
+        letter-spacing: 0.1em;
+        margin-top: 0.5rem;
+        opacity: 0.9;
+      }
+
+      .card-critical { background: rgba(239, 68, 68, 0.2); border-color: rgba(239, 68, 68, 0.4); }
+      .card-critical .count { color: #ef4444; }
+      .card-critical .label { color: #fca5a5; }
+
+      .card-high { background: rgba(245, 158, 11, 0.2); border-color: rgba(245, 158, 11, 0.4); }
+      .card-high .count { color: #f59e0b; }
+      .card-high .label { color: #fcd34d; }
+
+      .card-moderate { background: rgba(59, 130, 246, 0.2); border-color: rgba(59, 130, 246, 0.4); }
+      .card-moderate .count { color: #3b82f6; }
+      .card-moderate .label { color: #93c5fd; }
+
+      .card-low { background: rgba(107, 114, 128, 0.2); border-color: rgba(107, 114, 128, 0.4); }
+      .card-low .count { color: #9ca3af; }
+      .card-low .label { color: #d1d5db; }
+
+      .findings-list {
+        background: rgba(255, 255, 255, 0.05);
+        border-radius: 12px;
+        border: 1px solid rgba(255,255,255,0.1);
+        overflow: hidden;
+        backdrop-filter: blur(10px);
+      }
+
+      .finding-item {
+        padding: 1.25rem 1.5rem;
+        border-bottom: 1px solid rgba(255,255,255,0.06);
+        transition: background-color 0.2s;
+      }
+
+      .finding-item:last-child { border-bottom: none; }
+      .finding-item:hover { background: rgba(255,255,255,0.04); }
+
+      .finding-header {
+        display: flex;
+        align-items: center;
+        gap: 1rem;
+        margin-bottom: 0.5rem;
+        flex-wrap: wrap;
+      }
+
+      .severity-badge {
+        padding: 0.2rem 0.75rem;
+        border-radius: 9999px;
+        font-size: 0.7rem;
+        font-weight: 700;
+        text-transform: uppercase;
+        letter-spacing: 0.05em;
+      }
+
+      .severity-critical { background: #ef4444; color: white; }
+      .severity-high { background: #f59e0b; color: #1a1a2e; }
+      .severity-moderate { background: #3b82f6; color: white; }
+      .severity-low { background: #6b7280; color: white; }
+
+      .finding-name {
+        font-size: 1.2rem;
+        font-weight: 600;
+        color: #f1f5f9;
+      }
+
+      .finding-version {
+        font-family: 'Courier New', monospace;
+        font-size: 0.85rem;
+        padding: 0.15rem 0.6rem;
+        background: rgba(255,255,255,0.1);
+        border-radius: 4px;
+        color: #cbd5e1;
+      }
+
+      .source-tag {
+        font-size: 0.7rem;
+        padding: 0.15rem 0.6rem;
+        border-radius: 4px;
+        font-weight: 600;
+        text-transform: uppercase;
+        letter-spacing: 0.05em;
+      }
+
+      .source-known-malicious { background: rgba(239, 68, 68, 0.2); color: #fca5a5; border: 1px solid rgba(239, 68, 68, 0.3); }
+      .source-npm-audit { background: rgba(139, 92, 246, 0.2); color: #c4b5fd; border: 1px solid rgba(139, 92, 246, 0.3); }
+
+      .finding-description {
+        color: #94a3b8;
+        font-size: 0.9rem;
+        line-height: 1.5;
+        padding-left: 0.25rem;
+      }
+
+      .no-findings {
+        padding: 4rem 2rem;
+        text-align: center;
+      }
+
+      .no-findings .checkmark {
+        font-size: 4rem;
+        margin-bottom: 1rem;
+      }
+
+      .no-findings h2 {
+        color: #22c55e;
+        font-size: 1.5rem;
+        margin-bottom: 0.5rem;
+      }
+
+      .no-findings p {
+        color: #94a3b8;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="container">
+      <h1>Security Scan</h1>
+      <p class="subtitle">{{projectName}}</p>
+
+      {{#hasFindings}}
+      <div class="summary-cards">
+        {{#hasCritical}}
+        <div class="summary-card card-critical">
+          <div class="count">{{criticalCount}}</div>
+          <div class="label">Critical</div>
+        </div>
+        {{/hasCritical}}
+        {{#hasHigh}}
+        <div class="summary-card card-high">
+          <div class="count">{{highCount}}</div>
+          <div class="label">High</div>
+        </div>
+        {{/hasHigh}}
+        {{#hasModerate}}
+        <div class="summary-card card-moderate">
+          <div class="count">{{moderateCount}}</div>
+          <div class="label">Moderate</div>
+        </div>
+        {{/hasModerate}}
+        {{#hasLow}}
+        <div class="summary-card card-low">
+          <div class="count">{{lowCount}}</div>
+          <div class="label">Low</div>
+        </div>
+        {{/hasLow}}
+      </div>
+
+      <div class="findings-list">
+        {{#findings}}
+        <div class="finding-item">
+          <div class="finding-header">
+            <span class="severity-badge severity-{{severity}}">{{severity}}</span>
+            <span class="finding-name">{{name}}</span>
+            <span class="finding-version">{{installedVersion}}</span>
+            <span class="source-tag source-{{source}}">{{source}}</span>
+          </div>
+          <div class="finding-description">{{description}}</div>
+        </div>
+        {{/findings}}
+      </div>
+      {{/hasFindings}}
+
+      {{^hasFindings}}
+      <div class="findings-list">
+        <div class="no-findings">
+          <div class="checkmark">&#10003;</div>
+          <h2>All Clear</h2>
+          <p>No known malicious packages or vulnerabilities were found.</p>
+        </div>
+      </div>
+      {{/hasFindings}}
+    </div>
+  </body>
+</html>
+`;
+}
+function getPeerDepsTemplate() {
+    return `
+<html>
+  <head>
+    <title>{{projectName}} - Peer Dependencies</title>
+    <style>
+      * {
+        margin: 0;
+        padding: 0;
+        box-sizing: border-box;
+      }
+      
+      body {
+        font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
+        background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+        min-height: 100vh;
+        padding: 2rem;
+      }
+      
+      .container {
+        max-width: 1200px;
+        margin: 0 auto;
+      }
+      
+      h1 {
+        color: white;
+        margin-bottom: 2rem;
+        font-size: 2.5rem;
+        text-align: center;
+        text-shadow: 2px 2px 4px rgba(0,0,0,0.2);
+      }
+      
+      .peer-deps-list {
+        background: white;
+        border-radius: 12px;
+        box-shadow: 0 10px 40px rgba(0,0,0,0.1);
+        overflow: hidden;
+      }
+      
+      .peer-dep-item {
+        padding: 1.5rem;
+        border-bottom: 1px solid #e5e7eb;
+        transition: background-color 0.2s;
+      }
+      
+      .peer-dep-item:last-child {
+        border-bottom: none;
+      }
+      
+      .peer-dep-item:hover {
+        background-color: #f9fafb;
+      }
+      
+      .peer-dep-header {
+        display: flex;
+        justify-content: space-between;
+        align-items: center;
+        margin-bottom: 0.75rem;
+      }
+      
+      .peer-dep-name {
+        font-size: 1.25rem;
+        font-weight: 600;
+        color: #1f2937;
+      }
+      
+      .peer-dep-version {
+        font-family: 'Courier New', monospace;
+        padding: 0.25rem 0.75rem;
+        background: #f3f4f6;
+        border-radius: 6px;
+        font-size: 0.875rem;
+        color: #4b5563;
+      }
+      
+      .peer-dep-version.conflict {
+        background: #fee2e2;
+        color: #dc2626;
+        font-weight: 600;
+      }
+      
+      .peer-dep-info {
+        display: flex;
+        justify-content: space-between;
+        align-items: center;
+        flex-wrap: wrap;
+        gap: 1rem;
+      }
+      
+      .required-by {
+        flex: 1;
+        min-width: 200px;
+      }
+      
+      .required-by-label {
+        font-size: 0.75rem;
+        color: #6b7280;
+        text-transform: uppercase;
+        letter-spacing: 0.05em;
+        margin-bottom: 0.25rem;
+      }
+      
+      .required-by-list {
+        display: flex;
+        flex-wrap: wrap;
+        gap: 0.5rem;
+      }
+      
+      .required-by-tag {
+        display: inline-block;
+        padding: 0.25rem 0.5rem;
+        background: #dbeafe;
+        color: #1e40af;
+        border-radius: 4px;
+        font-size: 0.75rem;
+        font-weight: 500;
+      }
+      
+      .install-btn {
+        padding: 0.5rem 1.5rem;
+        background: #3b82f6;
+        color: white;
+        border: none;
+        border-radius: 6px;
+        font-size: 0.875rem;
+        font-weight: 500;
+        cursor: pointer;
+        transition: all 0.2s;
+        box-shadow: 0 2px 4px rgba(59, 130, 246, 0.3);
+      }
+      
+      .install-btn:hover {
+        background: #2563eb;
+        transform: translateY(-1px);
+        box-shadow: 0 4px 8px rgba(59, 130, 246, 0.4);
+      }
+      
+      .install-btn:active {
+        transform: translateY(0);
+      }
+      
+      .install-btn:disabled {
+        background: #9ca3af;
+        cursor: not-allowed;
+        transform: none;
+        box-shadow: none;
+      }
+      
+      .installed-badge {
+        display: flex;
+        align-items: center;
+        gap: 0.5rem;
+        padding: 0.5rem 1rem;
+        background: #d1fae5;
+        color: #065f46;
+        border-radius: 6px;
+        font-size: 0.875rem;
+        font-weight: 600;
+      }
+      
+      .installed-by-dep-badge {
+        display: flex;
+        align-items: center;
+        gap: 0.5rem;
+        padding: 0.5rem 1rem;
+        background: #e0e7ff;
+        color: #3730a3;
+        border-radius: 6px;
+        font-size: 0.875rem;
+        font-weight: 600;
+      }
+      
+      .checkmark {
+        color: #10b981;
+        font-size: 1.25rem;
+      }
+      
+      .message {
+        margin-top: 0.5rem;
+        padding: 0.5rem;
+        border-radius: 4px;
+        font-size: 0.875rem;
+        display: none;
+      }
+      
+      .message.success {
+        background: #d1fae5;
+        color: #065f46;
+        display: block;
+      }
+      
+      .message.error {
+        background: #fee2e2;
+        color: #dc2626;
+        display: block;
+      }
+
+      .no-deps {
+        padding: 3rem;
+        text-align: center;
+        color: #6b7280;
+        font-size: 1.125rem;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="container">
+      <h1>Peer Dependencies for {{projectName}}</h1>
+      <div class="peer-deps-list">
+        {{#peerDeps}}
+        <div class="peer-dep-item">
+          <div class="peer-dep-header">
+            <span class="peer-dep-name">{{name}}</span>
+            <span class="peer-dep-version {{#isConflict}}conflict{{/isConflict}}">
+              {{#isConflict}}Conflict: {{/isConflict}}{{version}}
+            </span>
+          </div>
+          <div class="peer-dep-info">
+            <div class="required-by">
+              <div class="required-by-label">Required by:</div>
+              <div class="required-by-list">
+                {{#requiredBy}}
+                <span class="required-by-tag">{{.}}</span>
+                {{/requiredBy}}
+              </div>
+            </div>
+            <div class="action-container">
+              {{#isInstalled}}
+              <div class="installed-badge">
+                Installed
+              </div>
+              {{/isInstalled}}
+              {{#isInstalledByDependency}}
+              <div class="installed-by-dep-badge">
+                Installed by dependency
+              </div>
+              {{/isInstalledByDependency}}
+              {{^isInstalled}}
+              {{^isInstalledByDependency}}
+              <button class="install-btn" onclick="installPackage('{{name}}', '{{version}}', this)">
+                npm install
+              </button>
+              <div class="message" id="msg-{{name}}"></div>
+              {{/isInstalledByDependency}}
+              {{/isInstalled}}
+            </div>
+          </div>
+        </div>
+        {{/peerDeps}}
+        {{^peerDeps}}
+        <div class="no-deps">
+          No peer dependencies found!
+        </div>
+        {{/peerDeps}}
+      </div>
+    </div>
+    
+    <script>
+      async function installPackage(packageName, version, button) {
+        const messageEl = document.getElementById('msg-' + packageName);
+        
+        button.disabled = true;
+        button.textContent = 'Installing...';
+        messageEl.className = 'message';
+        messageEl.textContent = '';
+        
+        try {
+          const response = await fetch('/install', {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              package: packageName,
+              version: version
+            })
+          });
+          
+          const result = await response.json();
+          
+          if (result.success) {
+            messageEl.className = 'message success';
+            messageEl.textContent = result.message;
+            button.style.display = 'none';
+            
+            // Optionally reload after a delay
+            setTimeout(() => {
+              location.reload();
+            }, 2000);
+          } else {
+            messageEl.className = 'message error';
+            messageEl.textContent = result.message;
+            button.disabled = false;
+            button.textContent = 'npm install';
+          }
+        } catch (error) {
+          messageEl.className = 'message error';
+          messageEl.textContent = 'Failed to install package: ' + error.message;
+          button.disabled = false;
+          button.textContent = 'npm install';
+        }
+      }
+    </script>
+  </body>
+</html>
+`;
+}
+function getTemplate() {
+    return `
+<html>
+  <head>
+    <title>{{name}}'s Dependency Graph</title>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/sigma.js/2.4.0/sigma.min.js"></script>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/graphology/0.25.4/graphology.umd.min.js"></script>
+    <script type="text/javascript">
+        function applyForceLayout(graph, iterations) {
+            var nodes = graph.nodes();
+            var edges = graph.edges();
+            
+            // Physics constants - lower repulsion for better spacing
+            var repulsionStrength = 50;
+            var attractionStrength = 0.01;
+            var damping = 0.5;
+            
+            for (var iter = 0; iter < iterations; iter++) {
+                var forces = {};
+                
+                // Initialize forces
+                nodes.forEach(function(nodeId) {
+                    forces[nodeId] = { x: 0, y: 0 };
+                });
+                
+                // Repulsive forces between all nodes
+                for (var i = 0; i < nodes.length; i++) {
+                    for (var j = i + 1; j < nodes.length; j++) {
+                        var node1 = nodes[i];
+                        var node2 = nodes[j];
+                        var attrs1 = graph.getNodeAttributes(node1);
+                        var attrs2 = graph.getNodeAttributes(node2);
+                        
+                        var dx = attrs2.x - attrs1.x;
+                        var dy = attrs2.y - attrs1.y;
+                        var distance = Math.sqrt(dx * dx + dy * dy) || 0.1;
+                        var force = repulsionStrength / (distance * distance);
+                        
+                        var fx = (dx / distance) * force;
+                        var fy = (dy / distance) * force;
+                        
+                        forces[node1].x -= fx;
+                        forces[node1].y -= fy;
+                        forces[node2].x += fx;
+                        forces[node2].y += fy;
+                    }
+                }
+                
+                // Attractive forces along edges
+                edges.forEach(function(edgeId) {
+                    var edge = graph.extremities(edgeId);
+                    var source = edge.source || edge[0];
+                    var target = edge.target || edge[1];
+                    var attrs1 = graph.getNodeAttributes(source);
+                    var attrs2 = graph.getNodeAttributes(target);
+                    
+                    var dx = attrs2.x - attrs1.x;
+                    var dy = attrs2.y - attrs1.y;
+                    var distance = Math.sqrt(dx * dx + dy * dy) || 0.1;
+                    
+                    var fx = dx * attractionStrength;
+                    var fy = dy * attractionStrength;
+                    
+                    forces[source].x += fx;
+                    forces[source].y += fy;
+                    forces[target].x -= fx;
+                    forces[target].y -= fy;
+                });
+                
+                // Apply forces with damping
+                nodes.forEach(function(nodeId) {
+                    var attrs = graph.getNodeAttributes(nodeId);
+                    attrs.x += forces[nodeId].x * damping;
+                    attrs.y += forces[nodeId].y * damping;
+                });
+            }
+        }
+    
+        function renderGraph() {
+            var nodes = {{{nodes}}};
+            var edges = {{{edges}}};
+            
+            var graph = new graphology.Graph();
+            
+            nodes.forEach(function(node) {
+                graph.addNode(node.key, {
+                    label: node.label,
+                    x: node.x,
+                    y: node.y,
+                    size: node.size,
+                    color: node.color
+                });
+            });
+            
+            edges.forEach(function(edge, index) {
+                graph.mergeEdge(edge.source, edge.target, {
+                    size: 2,
+                    color: '#94a3b8'
+                });
+            });
+            
+            // Apply custom force-directed layout
+            {{#applyForceLayout}}
+            applyForceLayout(graph, 100);
+            {{/applyForceLayout}}
+            
+            var container = document.getElementById("dep-graph");
+            var renderer = new Sigma(graph, container, {
+                renderEdgeLabels: false,
+                defaultNodeColor: '#3b82f6',
+                defaultEdgeColor: '#94a3b8'
+            });
+        }
+    </script>
+    <style>
+        body { margin: 0; padding: 0; }
+        #dep-graph { width: 100vw; height: 100vh; background: #f8fafc; }
+    </style>
+  </head>
+  <body onload="renderGraph()">
+    <div id="dep-graph"></div>
+  </body>
+</html>
 `;
 }