easy-dep-graph 1.1.3 → 1.2.1

package/bin/index.js

@@ -1,36 +1,1343 @@
 #! /usr/bin/env node
-import shell from "shelljs";
-import mustache from "mustache";
-import fastify from "fastify";
-import open from "open";
-import fs from "node:fs";
-import path from "node:path";
-import semver from "semver";
+import shell from 'shelljs';
+import mustache from 'mustache';
+import fastify from 'fastify';
+import open from 'open';
+import fs from 'node:fs';
+import path from 'node:path';
+import semver from 'semver';
 let flatDeps;
+// ─── Known Malicious / Compromised Packages Database ────────────────
+const knownMaliciousPackages = [
+    // === Compromised legitimate packages (specific bad versions) ===
+    {
+        name: 'axios',
+        badVersions: ['1.14.1', '0.30.4'],
+        severity: 'critical',
+        description: 'Compromised via maintainer account hijack (Mar 2026). Injected RAT malware via plain-crypto-js dependency.',
+    },
+    {
+        name: 'ua-parser-js',
+        badVersions: ['0.7.29', '0.8.0', '1.0.0'],
+        severity: 'critical',
+        description: 'Compromised via account hijack (Oct 2021). Installed crypto miners and Danabot trojan.',
+    },
+    {
+        name: 'coa',
+        badVersions: ['2.0.3', '2.0.4', '2.1.1', '2.1.3', '3.1.3'],
+        severity: 'critical',
+        description: 'Compromised via account hijack (Nov 2021). Malicious preinstall script downloaded Danabot trojan.',
+    },
+    {
+        name: 'rc',
+        badVersions: ['1.2.9', '1.3.9', '2.3.9'],
+        severity: 'critical',
+        description: 'Compromised via account hijack (Nov 2021). Same Danabot trojan payload as coa.',
+    },
+    {
+        name: 'event-stream',
+        badVersions: ['3.3.6'],
+        severity: 'critical',
+        description: 'Compromised via social-engineered maintainer transfer (Nov 2018). Stole Bitcoin from Copay wallets via flatmap-stream.',
+    },
+    {
+        name: 'colors',
+        badVersions: ['1.4.1', '1.4.44-liberty-2'],
+        severity: 'high',
+        description: 'Sabotaged by maintainer (Jan 2022). Infinite loop printing zalgo text causing DoS. Use 1.4.0 instead.',
+    },
+    {
+        name: 'faker',
+        badVersions: ['6.6.6'],
+        severity: 'high',
+        description: 'Sabotaged by maintainer (Jan 2022). Package contents wiped. Use @faker-js/faker instead.',
+    },
+    {
+        name: 'node-ipc',
+        badVersions: ['10.1.1', '10.1.2', '9.2.2', '11.0.0', '11.1.0'],
+        severity: 'critical',
+        description: 'Protestware (Mar 2022). Geo-targeted file destruction for Russian/Belarusian IPs. CVE-2022-23812.',
+    },
+    {
+        name: 'eslint-scope',
+        badVersions: ['3.7.2'],
+        severity: 'critical',
+        description: 'Compromised (Jul 2018). Stole npm tokens from developer machines.',
+    },
+    // === Always-malicious packages (any version) ===
+    {
+        name: 'flatmap-stream',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Malicious package used in event-stream supply chain attack. Stole cryptocurrency credentials.',
+    },
+    {
+        name: 'plain-crypto-js',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Malicious dependency injected into compromised axios versions. Delivers cross-platform RAT.',
+    },
+    {
+        name: 'peacenotwar',
+        badVersions: '*',
+        severity: 'high',
+        description: 'Protestware dropped by compromised node-ipc. Writes files to user desktop.',
+    },
+    {
+        name: 'getcookies',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Backdoor hidden in express middleware (May 2018). Remote code execution.',
+    },
+    {
+        name: 'crossenv',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of cross-env. Steals environment variables and npm tokens.',
+    },
+    {
+        name: 'event-strem',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of event-stream. Credential theft.',
+    },
+    {
+        name: 'lodahs',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of lodash. Malware dropper.',
+    },
+    {
+        name: 'babelcli',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of babel-cli. Steals environment variables.',
+    },
+    {
+        name: 'd3.js',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of d3. Credential theft.',
+    },
+    {
+        name: 'ffmpegs',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of ffmpeg. Crypto miner.',
+    },
+    {
+        name: 'gruntcli',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of grunt-cli. Steals environment variables.',
+    },
+    {
+        name: 'http-proxy.js',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of http-proxy. Credential theft.',
+    },
+    {
+        name: 'mongose',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of mongoose. Steals environment variables.',
+    },
+    {
+        name: 'node-fabric',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of fabric. Opens remote shell.',
+    },
+    {
+        name: 'node-opencv',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of opencv. Credential theft.',
+    },
+    {
+        name: 'node-opensl',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of openssl. Credential theft.',
+    },
+    {
+        name: 'node-openssl',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of openssl. Credential theft.',
+    },
+    {
+        name: 'nodecaffe',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of node-caffe. Credential theft.',
+    },
+    {
+        name: 'nodefabric',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of node-fabric. Credential theft.',
+    },
+    {
+        name: 'nodemailer-js',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of nodemailer. Credential theft.',
+    },
+    {
+        name: 'noderequest',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of request. Credential theft.',
+    },
+    {
+        name: 'nodesass',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of node-sass. Credential theft.',
+    },
+    {
+        name: 'nodesqlite',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of sqlite. Credential theft.',
+    },
+    {
+        name: 'shadowsock',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of shadowsocks. Credential theft.',
+    },
+    {
+        name: 'sqlite.js',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of sqlite3. Credential theft.',
+    },
+    {
+        name: 'proxy.js',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of proxy. Credential theft.',
+    },
+    {
+        name: 'discorsd.js',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of discord.js. Token stealer.',
+    },
+    {
+        name: 'colored',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of colors. Credential theft.',
+    },
+    {
+        name: 'mariadb',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Typosquat of mariasql. Credential theft.',
+    },
+    {
+        name: 'electron-native-notify',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Malicious package (Jun 2019). Stole cryptocurrency credentials.',
+    },
+    {
+        name: 'rest-client',
+        badVersions: '*',
+        severity: 'critical',
+        description: 'Malicious package (Aug 2019). Injected code to steal credentials.',
+    },
+    {
+        name: 'bootstrap-sass',
+        badVersions: '*',
+        severity: 'high',
+        description: 'Typosquat with crypto miner.',
+    },
+    // === TanStack ecosystem compromise (May 2026) ===
+    // Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
+    // CVE-2026-45321: https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx
+    {
+        name: '@tanstack/arktype-adapter',
+        badVersions: ['1.166.12', '1.166.15'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/eslint-plugin-router',
+        badVersions: ['1.161.9', '1.161.12'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/eslint-plugin-start',
+        badVersions: ['0.0.4', '0.0.7'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/history',
+        badVersions: ['1.161.9', '1.161.12'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/nitro-v2-vite-plugin',
+        badVersions: ['1.154.12', '1.154.15'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/react-router',
+        badVersions: ['1.169.5', '1.169.8'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/react-router-devtools',
+        badVersions: ['1.166.16', '1.166.19'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/react-router-ssr-query',
+        badVersions: ['1.166.15', '1.166.18'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/react-start',
+        badVersions: ['1.167.68', '1.167.71'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/react-start-client',
+        badVersions: ['1.166.51', '1.166.54'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/react-start-rsc',
+        badVersions: ['0.0.47', '0.0.50'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/react-start-server',
+        badVersions: ['1.166.55', '1.166.58'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/router-cli',
+        badVersions: ['1.166.46', '1.166.49'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/router-core',
+        badVersions: ['1.169.5', '1.169.8'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/router-devtools',
+        badVersions: ['1.166.16', '1.166.19'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/router-devtools-core',
+        badVersions: ['1.167.6', '1.167.9'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/router-generator',
+        badVersions: ['1.166.45', '1.166.48'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/router-plugin',
+        badVersions: ['1.167.38', '1.167.41'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/router-ssr-query-core',
+        badVersions: ['1.168.3', '1.168.6'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/router-utils',
+        badVersions: ['1.161.11', '1.161.14'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/router-vite-plugin',
+        badVersions: ['1.166.53', '1.166.56'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/solid-router',
+        badVersions: ['1.169.5', '1.169.8'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/solid-router-devtools',
+        badVersions: ['1.166.16', '1.166.19'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/solid-router-ssr-query',
+        badVersions: ['1.166.15', '1.166.18'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/solid-start',
+        badVersions: ['1.167.65', '1.167.68'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/solid-start-client',
+        badVersions: ['1.166.50', '1.166.53'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/solid-start-server',
+        badVersions: ['1.166.54', '1.166.57'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/start-client-core',
+        badVersions: ['1.168.5', '1.168.8'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/start-fn-stubs',
+        badVersions: ['1.161.9', '1.161.12'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/start-plugin-core',
+        badVersions: ['1.169.23', '1.169.26'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/start-server-core',
+        badVersions: ['1.167.33', '1.167.36'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/start-static-server-functions',
+        badVersions: ['1.166.44', '1.166.47'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/start-storage-context',
+        badVersions: ['1.166.38', '1.166.41'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/valibot-adapter',
+        badVersions: ['1.166.12', '1.166.15'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/virtual-file-routes',
+        badVersions: ['1.161.10', '1.161.13'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/vue-router',
+        badVersions: ['1.169.5', '1.169.8'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/vue-router-devtools',
+        badVersions: ['1.166.16', '1.166.19'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/vue-router-ssr-query',
+        badVersions: ['1.166.15', '1.166.18'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/vue-start',
+        badVersions: ['1.167.61', '1.167.64'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/vue-start-client',
+        badVersions: ['1.166.46', '1.166.49'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/vue-start-server',
+        badVersions: ['1.166.50', '1.166.53'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    {
+        name: '@tanstack/zod-adapter',
+        badVersions: ['1.166.12', '1.166.15'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Malware exfiltrates AWS/GCP credentials, GitHub tokens, SSH keys, and npm tokens. CVE-2026-45321.',
+    },
+    // === Mistral AI compromise (May 2026) ===
+    // Part of "Mini Shai-Hulud is back" worm by TeamPCP threat actor (GHSA-3q49-cfcf-g5fm)
+    {
+        name: '@mistralai/mistralai',
+        badVersions: ['2.2.2', '2.2.3', '2.2.4'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm. Steals credentials and propagates to accessed packages. Full system compromise. GHSA-3q49-cfcf-g5fm.',
+    },
+    {
+        name: '@mistralai/mistralai-azure',
+        badVersions: ['1.7.1', '1.7.2', '1.7.3'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm. Malware exfiltrates credentials and propagates to accessed packages.',
+    },
+    {
+        name: '@mistralai/mistralai-gcp',
+        badVersions: ['1.7.1', '1.7.2', '1.7.3'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm. Malware exfiltrates credentials and propagates to accessed packages.',
+    },
+    // === UIPath supply chain compromise (May 2026) ===
+    {
+        name: '@uipath/packager-tool-functions',
+        badVersions: ['0.1.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/docsai-tool',
+        badVersions: ['1.0.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/context-grounding-tool',
+        badVersions: ['0.1.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/apollo-core',
+        badVersions: ['5.9.2'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/flow-tool',
+        badVersions: ['1.0.2'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/maestro-tool',
+        badVersions: ['1.0.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/robot',
+        badVersions: ['1.3.4'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/integrationservice-tool',
+        badVersions: ['1.0.2'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/agent-tool',
+        badVersions: ['1.0.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/access-policy-sdk',
+        badVersions: ['0.3.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/rpa-tool',
+        badVersions: ['0.9.5'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/apollo-wind',
+        badVersions: ['2.16.2'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/widget.sdk',
+        badVersions: ['1.2.3'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/common',
+        badVersions: ['1.0.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/functions-tool',
+        badVersions: ['1.0.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/cli',
+        badVersions: ['1.0.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/test-manager-tool',
+        badVersions: ['1.0.2'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/packager-tool-apiworkflow',
+        badVersions: ['0.0.19'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/insights-sdk',
+        badVersions: ['1.0.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/rpa-legacy-tool',
+        badVersions: ['1.0.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/solution-packager',
+        badVersions: ['0.0.35'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/api-workflow-tool',
+        badVersions: ['1.0.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/resources-tool',
+        badVersions: ['0.1.11'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/ui-widgets-multi-file-upload',
+        badVersions: ['1.0.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/codedagents-tool',
+        badVersions: ['0.1.12'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/admin-tool',
+        badVersions: ['0.1.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/tool-workflowcompiler',
+        badVersions: ['0.0.12'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/telemetry',
+        badVersions: ['0.0.7'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/resourcecatalog-tool',
+        badVersions: ['0.1.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/aops-policy-tool',
+        badVersions: ['0.3.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/identity-tool',
+        badVersions: ['0.1.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/packager-tool-bpmn',
+        badVersions: ['0.0.9'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/case-tool',
+        badVersions: ['1.0.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/ap-chat',
+        badVersions: ['1.5.7'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/solutionpackager-sdk',
+        badVersions: ['1.0.11'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/agent-sdk',
+        badVersions: ['1.0.2'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/vss',
+        badVersions: ['0.1.6'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/solution-tool',
+        badVersions: ['1.0.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/maestro-sdk',
+        badVersions: ['1.0.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/packager-tool-workflowcompiler',
+        badVersions: ['0.0.16'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/data-fabric-tool',
+        badVersions: ['1.0.2'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/project-packager',
+        badVersions: ['1.1.16'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/orchestrator-tool',
+        badVersions: ['1.0.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/packager-tool-connector',
+        badVersions: ['0.0.19'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/tasks-tool',
+        badVersions: ['1.0.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/packager-tool-flow',
+        badVersions: ['0.0.19'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/integrationservice-sdk',
+        badVersions: ['1.0.2'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/solutionpackager-tool-core',
+        badVersions: ['0.0.34'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/vertical-solutions-tool',
+        badVersions: ['1.0.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/insights-tool',
+        badVersions: ['1.0.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/auth',
+        badVersions: ['1.0.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/llmgw-tool',
+        badVersions: ['1.0.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/packager-tool-workflowcompiler-browser',
+        badVersions: ['0.0.34'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/platform-tool',
+        badVersions: ['1.0.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/codedagent-tool',
+        badVersions: ['1.0.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/codedapp-tool',
+        badVersions: ['1.0.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/resource-tool',
+        badVersions: ['1.0.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/gov-tool',
+        badVersions: ['0.3.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/access-policy-tool',
+        badVersions: ['0.3.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/packager-tool-case',
+        badVersions: ['0.0.9'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/packager-tool-webapp',
+        badVersions: ['1.0.6'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/traces-tool',
+        badVersions: ['1.0.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/filesystem',
+        badVersions: ['1.0.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/uipath-python-bridge',
+        badVersions: ['1.0.1'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/apollo-react',
+        badVersions: ['4.24.5'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@uipath/agent.sdk',
+        badVersions: ['0.0.18'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    // === ML Toolkit compromise (May 2026) ===
+    {
+        name: '@ml-toolkit-ts/xgboost',
+        badVersions: ['1.0.3', '1.0.4'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: 'ml-toolkit-ts',
+        badVersions: ['1.0.4', '1.0.5'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@ml-toolkit-ts/preprocessing',
+        badVersions: ['1.0.2', '1.0.3'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    // === Other ecosystem compromises (May 2026) ===
+    {
+        name: '@supersurkhet/cli',
+        badVersions: ['0.0.2', '0.0.3', '0.0.4', '0.0.5', '0.0.6', '0.0.7'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@supersurkhet/sdk',
+        badVersions: ['0.0.2', '0.0.3', '0.0.4', '0.0.5', '0.0.6', '0.0.7'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@taskflow-corp/cli',
+        badVersions: ['0.1.24', '0.1.25', '0.1.26', '0.1.27', '0.1.28', '0.1.29'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: 'safe-action',
+        badVersions: ['0.8.3', '0.8.4'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@draftlab/auth',
+        badVersions: ['0.24.1', '0.24.2'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@draftlab/auth-router',
+        badVersions: ['0.5.1', '0.5.2'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@draftlab/db',
+        badVersions: ['0.16.1', '0.16.2'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@tolka/cli',
+        badVersions: ['1.0.2', '1.0.3', '1.0.4', '1.0.5', '1.0.6'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@dirigible-ai/sdk',
+        badVersions: ['0.6.2', '0.6.3'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@beproduct/nestjs-auth',
+        badVersions: [
+            '0.1.2',
+            '0.1.3',
+            '0.1.4',
+            '0.1.5',
+            '0.1.6',
+            '0.1.7',
+            '0.1.8',
+            '0.1.9',
+            '0.1.10',
+            '0.1.11',
+            '0.1.12',
+            '0.1.13',
+            '0.1.14',
+            '0.1.15',
+            '0.1.16',
+            '0.1.17',
+            '0.1.18',
+            '0.1.19',
+        ],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: 'cmux-agent-mcp',
+        badVersions: ['0.1.3', '0.1.4', '0.1.5', '0.1.6', '0.1.7', '0.1.8'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: 'git-branch-selector',
+        badVersions: ['1.3.3', '1.3.4', '1.3.5', '1.3.6', '1.3.7'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: 'agentwork-cli',
+        badVersions: ['0.1.4', '0.1.5'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@draftauth/core',
+        badVersions: ['0.13.1', '0.13.2'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@draftauth/client',
+        badVersions: ['0.2.1', '0.2.2'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: 'git-git-git',
+        badVersions: ['1.0.8', '1.0.9', '1.0.10', '1.0.11', '1.0.12'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: 'nextmove-mcp',
+        badVersions: ['0.1.3', '0.1.4', '0.1.5', '0.1.6', '0.1.7'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: 'cross-stitch',
+        badVersions: ['1.1.3', '1.1.4', '1.1.5', '1.1.6', '1.1.7'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    // === Squawk ecosystem compromise (May 2026) ===
+    {
+        name: '@squawk/fix-data',
+        badVersions: ['0.6.4', '0.6.5', '0.6.6', '0.6.7', '0.6.8'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@squawk/weather',
+        badVersions: ['0.5.6', '0.5.7', '0.5.8', '0.5.9', '0.5.10'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@squawk/icao-registry-data',
+        badVersions: ['0.8.4', '0.8.5', '0.8.6', '0.8.7', '0.8.8'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@squawk/airport-data',
+        badVersions: ['0.7.4', '0.7.5', '0.7.6', '0.7.7', '0.7.8'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@squawk/flightplan',
+        badVersions: ['0.5.2', '0.5.3', '0.5.4', '0.5.5', '0.5.6'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@squawk/units',
+        badVersions: ['0.4.3', '0.4.4', '0.4.5', '0.4.6', '0.4.7'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@squawk/flight-math',
+        badVersions: ['0.5.4', '0.5.5', '0.5.6', '0.5.7', '0.5.8'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@squawk/fixes',
+        badVersions: ['0.3.2', '0.3.3', '0.3.4', '0.3.5', '0.3.6'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@squawk/airspace-data',
+        badVersions: ['0.5.3', '0.5.4', '0.5.5', '0.5.6', '0.5.7'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@squawk/procedure-data',
+        badVersions: ['0.7.3', '0.7.4', '0.7.5', '0.7.6', '0.7.7'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@squawk/navaids',
+        badVersions: ['0.4.2', '0.4.3', '0.4.4', '0.4.5', '0.4.6'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@squawk/notams',
+        badVersions: ['0.3.6', '0.3.7', '0.3.8', '0.3.9', '0.3.10'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@squawk/airways',
+        badVersions: ['0.4.2', '0.4.3', '0.4.4', '0.4.5', '0.4.6'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@squawk/airports',
+        badVersions: ['0.6.2', '0.6.3', '0.6.4', '0.6.5', '0.6.6'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@squawk/icao-registry',
+        badVersions: ['0.5.2', '0.5.3', '0.5.4', '0.5.5', '0.5.6'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@squawk/airspace',
+        badVersions: ['0.8.1', '0.8.2', '0.8.3', '0.8.4', '0.8.5'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@squawk/geo',
+        badVersions: ['0.4.4', '0.4.5', '0.4.6', '0.4.7', '0.4.8'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@squawk/navaid-data',
+        badVersions: ['0.6.4', '0.6.5', '0.6.6', '0.6.7', '0.6.8'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@squawk/airway-data',
+        badVersions: ['0.5.4', '0.5.5', '0.5.6', '0.5.7', '0.5.8'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@squawk/mcp',
+        badVersions: ['0.9.1', '0.9.2', '0.9.3', '0.9.4', '0.9.5'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@squawk/procedures',
+        badVersions: ['0.5.2', '0.5.3', '0.5.4', '0.5.5', '0.5.6'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@squawk/types',
+        badVersions: ['0.8.1', '0.8.2', '0.8.3', '0.8.4', '0.8.5'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    // === Additional compromise (May 2026) ===
+    {
+        name: 'ts-dna',
+        badVersions: ['3.0.1', '3.0.2', '3.0.3', '3.0.4', '3.0.5'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    // === TallyUI ecosystem compromise (May 2026) ===
+    {
+        name: '@tallyui/pos',
+        badVersions: ['0.1.1', '0.1.2', '0.1.3'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@tallyui/connector-vendure',
+        badVersions: ['1.0.1', '1.0.2', '1.0.3'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@tallyui/connector-shopify',
+        badVersions: ['1.0.1', '1.0.2', '1.0.3'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@tallyui/components',
+        badVersions: ['1.0.1', '1.0.2', '1.0.3'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@tallyui/theme',
+        badVersions: ['0.2.1', '0.2.2', '0.2.3'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: 'wot-api',
+        badVersions: ['0.8.1', '0.8.2', '0.8.3', '0.8.4'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@tallyui/storage-sqlite',
+        badVersions: ['0.2.1', '0.2.2', '0.2.3'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@tallyui/connector-woocommerce',
+        badVersions: ['1.0.1', '1.0.2', '1.0.3'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@tallyui/database',
+        badVersions: ['1.0.1', '1.0.2', '1.0.3'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@tallyui/connector-medusa',
+        badVersions: ['1.0.1', '1.0.2', '1.0.3'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@tallyui/core',
+        badVersions: ['0.2.1', '0.2.2', '0.2.3'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    // === Mesa/MesaDev compromise (May 2026) ===
+    {
+        name: '@mesadev/saguaro',
+        badVersions: ['0.4.22'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@mesadev/sdk',
+        badVersions: ['0.28.3'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    {
+        name: '@mesadev/rest',
+        badVersions: ['0.28.3'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+    // === OpenSearch compromise (May 2026) ===
+    {
+        name: '@opensearch-project/opensearch',
+        badVersions: ['3.5.3', '3.6.2', '3.7.0', '3.8.0'],
+        severity: 'critical',
+        description: 'Compromised (May 2026). Part of "Mini Shai-Hulud is back" worm.',
+    },
+];
 void (async function main() {
     // Check if peer dependencies mode
-    const peerDependenciesMode = process.argv.findIndex((a) => a.toLowerCase() === "--peer-dependencies") !==
-        -1;
+    const peerDependenciesMode = process.argv.findIndex((a) => a.toLowerCase() === '--peer-dependencies') !== -1;
     // List of packages user wants to see the dependencies
-    const packagesArgIndex = process.argv.findIndex((a) => a.toLowerCase() === "--packages");
+    const packagesArgIndex = process.argv.findIndex((a) => a.toLowerCase() === '--packages');
     const packagesFilter = packagesArgIndex !== -1 ? process.argv[packagesArgIndex + 1] : undefined;
     // Only get the dependents of a specific package
-    const packageArgIndex = process.argv.findIndex((a) => a.toLowerCase() === "--package-dependents");
+    const packageArgIndex = process.argv.findIndex((a) => a.toLowerCase() === '--package-dependents');
     const packageName = packageArgIndex !== -1 ? process.argv[packageArgIndex + 1] : undefined;
     // Get port number
-    const portArgIndex = process.argv.findIndex((a) => a.toLowerCase() === "--port");
+    const portArgIndex = process.argv.findIndex((a) => a.toLowerCase() === '--port');
     const port = portArgIndex !== -1 ? +process.argv[portArgIndex + 1] : 8080;
     // Get if should not open browser
-    const shouldOpenBrowser = process.argv.findIndex((a) => a.toLowerCase() === "--no-open") === -1;
+    const shouldOpenBrowser = process.argv.findIndex((a) => a.toLowerCase() === '--no-open') === -1;
     // Get if should not apply force layout
-    const shouldApplyForceLayout = process.argv.findIndex((a) => a.toLowerCase() === "--no-force-layout") ===
-        -1;
+    const shouldApplyForceLayout = process.argv.findIndex((a) => a.toLowerCase() === '--no-force-layout') === -1;
+    // Check if security scan mode
+    const securityScanMode = process.argv.findIndex((a) => a.toLowerCase() === '--security-scan') !== -1;
+    if (securityScanMode) {
+        await runSecurityScanMode(port, shouldOpenBrowser);
+        return;
+    }
     if (peerDependenciesMode) {
         await runPeerDependenciesMode(port, shouldOpenBrowser);
         return;
     }
     // Run npm list command
-    const result = shell.exec(`npm list --json ${packageName ?? "--all"}`, {
+    const result = shell.exec(`npm list --json ${packageName ?? '--all'}`, {
         windowsHide: true,
         silent: true,
     });
@@ -39,7 +1346,7 @@ void (async function main() {
     console.log(`Generating dependency graph for: "${packageInfo.name}"...`);
     // Filter dependencies if needed
     if (packagesFilter != null) {
-        const packagesFilterList = packagesFilter.split(",").map((d) => d.trim());
+        const packagesFilterList = packagesFilter.split(',').map((d) => d.trim());
         for (const key of Object.keys(packageInfo.dependencies)) {
             if (!packagesFilterList.includes(key)) {
                 delete packageInfo.dependencies[key];
@@ -75,7 +1382,7 @@ void (async function main() {
                 x,
                 y,
                 size: 10,
-                color: dep[1].isRoot ? "#22c55e" : "#3b82f6",
+                color: dep[1].isRoot ? '#22c55e' : '#3b82f6',
             };
         })),
         edges: JSON.stringify(Object.entries(flatDeps)
@@ -91,7 +1398,7 @@ void (async function main() {
     const app = fastify({
         logger: false,
     });
-    app.get("/", (_req, resp) => resp.type("text/html").send(html));
+    app.get('/', (_req, resp) => resp.type('text/html').send(html));
     // Run the server
     app.listen({ port }, (err, address) => {
         if (err)
@@ -123,10 +1430,10 @@ function flatDepsRecursive(deps, parentDepName) {
     }
 }
 async function runPeerDependenciesMode(port, shouldOpenBrowser) {
-    console.log("Analyzing peer dependencies...");
+    console.log('Analyzing peer dependencies...');
     // Get the current project's package.json
-    const packageJsonPath = path.join(process.cwd(), "package.json");
-    const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"));
+    const packageJsonPath = path.join(process.cwd(), 'package.json');
+    const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
     const installedPackages = {
         ...packageJson.dependencies,
         ...packageJson.devDependencies,
@@ -138,8 +1445,8 @@ async function runPeerDependenciesMode(port, shouldOpenBrowser) {
         const resolvedVersion = resolveVersion(info.versions);
         const isInPackageJson = installedPackages[name] !== undefined;
         // Check if installed in node_modules (even if not in package.json)
-        const nodeModulesPath = path.join(process.cwd(), "node_modules");
-        const pkgPath = path.join(nodeModulesPath, name, "package.json");
+        const nodeModulesPath = path.join(process.cwd(), 'node_modules');
+        const pkgPath = path.join(nodeModulesPath, name, 'package.json');
         const existsInNodeModules = fs.existsSync(pkgPath);
         const isInstalledByDependency = existsInNodeModules && !isInPackageJson;
         return {
@@ -163,8 +1470,8 @@ async function runPeerDependenciesMode(port, shouldOpenBrowser) {
     const app = fastify({
         logger: false,
     });
-    app.get("/", (_req, resp) => resp.type("text/html").send(html));
-    app.post("/install", async (req, resp) => {
+    app.get('/', (_req, resp) => resp.type('text/html').send(html));
+    app.post('/install', async (req, resp) => {
         const { package: pkg, version } = req.body;
         console.log(`Installing ${pkg}@${version}...`);
         const installResult = shell.exec(`npm install ${pkg}@${version}`, {
@@ -182,7 +1489,7 @@ async function runPeerDependenciesMode(port, shouldOpenBrowser) {
             console.error(`Failed to install ${pkg}@${version}`);
             return {
                 success: false,
-                message: installResult.stderr || "Installation failed",
+                message: installResult.stderr || 'Installation failed',
             };
         }
     });
@@ -197,7 +1504,7 @@ async function runPeerDependenciesMode(port, shouldOpenBrowser) {
 }
 function collectPeerDependenciesRecursively(initialPackages) {
     const peerDeps = {};
-    const nodeModulesPath = path.join(process.cwd(), "node_modules");
+    const nodeModulesPath = path.join(process.cwd(), 'node_modules');
     const visited = new Set();
     const queue = Object.keys(initialPackages);
     while (queue.length > 0) {
@@ -208,11 +1515,11 @@ function collectPeerDependenciesRecursively(initialPackages) {
         }
         visited.add(packageName);
         try {
-            const pkgJsonPath = path.join(nodeModulesPath, packageName, "package.json");
+            const pkgJsonPath = path.join(nodeModulesPath, packageName, 'package.json');
             if (!fs.existsSync(pkgJsonPath)) {
                 continue;
             }
-            const pkgJson = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+            const pkgJson = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8'));
             // Collect peer dependencies
             if (pkgJson.peerDependencies) {
                 for (const [peerDepName, peerDepVersion] of Object.entries(pkgJson.peerDependencies)) {
@@ -254,7 +1561,7 @@ function collectPeerDependenciesRecursively(initialPackages) {
 }
 function resolveVersion(versions) {
     if (versions.length === 0) {
-        return { version: "*", isConflict: false };
+        return { version: '*', isConflict: false };
     }
     if (versions.length === 1) {
         return { version: versions[0], isConflict: false };
@@ -286,445 +1593,863 @@ function resolveVersion(versions) {
             }
             else {
                 // Ranges don't intersect - conflict detected
-                return { version: uniqueVersions.join(" | "), isConflict: true };
+                return { version: uniqueVersions.join(' | '), isConflict: true };
             }
         }
         return { version: intersection, isConflict: false };
     }
     catch (error) {
         // If semver parsing fails, fall back to showing all versions
-        return { version: uniqueVersions.join(" | "), isConflict: true };
+        return { version: uniqueVersions.join(' | '), isConflict: true };
     }
 }
-function getPeerDepsTemplate() {
-    return `
-<html>
-  <head>
-    <title>{{projectName}} - Peer Dependencies</title>
-    <style>
-      * {
-        margin: 0;
-        padding: 0;
-        box-sizing: border-box;
-      }
-      
-      body {
-        font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
-        background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
-        min-height: 100vh;
-        padding: 2rem;
-      }
-      
-      .container {
-        max-width: 1200px;
-        margin: 0 auto;
-      }
-      
-      h1 {
-        color: white;
-        margin-bottom: 2rem;
-        font-size: 2.5rem;
-        text-align: center;
-        text-shadow: 2px 2px 4px rgba(0,0,0,0.2);
-      }
-      
-      .peer-deps-list {
-        background: white;
-        border-radius: 12px;
-        box-shadow: 0 10px 40px rgba(0,0,0,0.1);
-        overflow: hidden;
-      }
-      
-      .peer-dep-item {
-        padding: 1.5rem;
-        border-bottom: 1px solid #e5e7eb;
-        transition: background-color 0.2s;
-      }
-      
-      .peer-dep-item:last-child {
-        border-bottom: none;
-      }
-      
-      .peer-dep-item:hover {
-        background-color: #f9fafb;
-      }
-      
-      .peer-dep-header {
-        display: flex;
-        justify-content: space-between;
-        align-items: center;
-        margin-bottom: 0.75rem;
-      }
-      
-      .peer-dep-name {
-        font-size: 1.25rem;
-        font-weight: 600;
-        color: #1f2937;
-      }
-      
-      .peer-dep-version {
-        font-family: 'Courier New', monospace;
-        padding: 0.25rem 0.75rem;
-        background: #f3f4f6;
-        border-radius: 6px;
-        font-size: 0.875rem;
-        color: #4b5563;
-      }
-      
-      .peer-dep-version.conflict {
-        background: #fee2e2;
-        color: #dc2626;
-        font-weight: 600;
-      }
-      
-      .peer-dep-info {
-        display: flex;
-        justify-content: space-between;
-        align-items: center;
-        flex-wrap: wrap;
-        gap: 1rem;
-      }
-      
-      .required-by {
-        flex: 1;
-        min-width: 200px;
-      }
-      
-      .required-by-label {
-        font-size: 0.75rem;
-        color: #6b7280;
-        text-transform: uppercase;
-        letter-spacing: 0.05em;
-        margin-bottom: 0.25rem;
-      }
-      
-      .required-by-list {
-        display: flex;
-        flex-wrap: wrap;
-        gap: 0.5rem;
-      }
-      
-      .required-by-tag {
-        display: inline-block;
-        padding: 0.25rem 0.5rem;
-        background: #dbeafe;
-        color: #1e40af;
-        border-radius: 4px;
-        font-size: 0.75rem;
-        font-weight: 500;
-      }
-      
-      .install-btn {
-        padding: 0.5rem 1.5rem;
-        background: #3b82f6;
-        color: white;
-        border: none;
-        border-radius: 6px;
-        font-size: 0.875rem;
-        font-weight: 500;
-        cursor: pointer;
-        transition: all 0.2s;
-        box-shadow: 0 2px 4px rgba(59, 130, 246, 0.3);
-      }
-      
-      .install-btn:hover {
-        background: #2563eb;
-        transform: translateY(-1px);
-        box-shadow: 0 4px 8px rgba(59, 130, 246, 0.4);
-      }
-      
-      .install-btn:active {
-        transform: translateY(0);
-      }
-      
-      .install-btn:disabled {
-        background: #9ca3af;
-        cursor: not-allowed;
-        transform: none;
-        box-shadow: none;
-      }
-      
-      .installed-badge {
-        display: flex;
-        align-items: center;
-        gap: 0.5rem;
-        padding: 0.5rem 1rem;
-        background: #d1fae5;
-        color: #065f46;
-        border-radius: 6px;
-        font-size: 0.875rem;
-        font-weight: 600;
-      }
-      
-      .installed-by-dep-badge {
-        display: flex;
-        align-items: center;
-        gap: 0.5rem;
-        padding: 0.5rem 1rem;
-        background: #e0e7ff;
-        color: #3730a3;
-        border-radius: 6px;
-        font-size: 0.875rem;
-        font-weight: 600;
-      }
-      
-      .checkmark {
-        color: #10b981;
-        font-size: 1.25rem;
-      }
-      
-      .message {
-        margin-top: 0.5rem;
-        padding: 0.5rem;
-        border-radius: 4px;
-        font-size: 0.875rem;
-        display: none;
-      }
-      
-      .message.success {
-        background: #d1fae5;
-        color: #065f46;
-        display: block;
-      }
-      
-      .message.error {
-        background: #fee2e2;
-        color: #dc2626;
-        display: block;
-      }
-
-      .no-deps {
-        padding: 3rem;
-        text-align: center;
-        color: #6b7280;
-        font-size: 1.125rem;
-      }
-    </style>
-  </head>
-  <body>
-    <div class="container">
-      <h1>Peer Dependencies for {{projectName}}</h1>
-      <div class="peer-deps-list">
-        {{#peerDeps}}
-        <div class="peer-dep-item">
-          <div class="peer-dep-header">
-            <span class="peer-dep-name">{{name}}</span>
-            <span class="peer-dep-version {{#isConflict}}conflict{{/isConflict}}">
-              {{#isConflict}}Conflict: {{/isConflict}}{{version}}
-            </span>
-          </div>
-          <div class="peer-dep-info">
-            <div class="required-by">
-              <div class="required-by-label">Required by:</div>
-              <div class="required-by-list">
-                {{#requiredBy}}
-                <span class="required-by-tag">{{.}}</span>
-                {{/requiredBy}}
-              </div>
-            </div>
-            <div class="action-container">
-              {{#isInstalled}}
-              <div class="installed-badge">
-                Installed
-              </div>
-              {{/isInstalled}}
-              {{#isInstalledByDependency}}
-              <div class="installed-by-dep-badge">
-                Installed by dependency
-              </div>
-              {{/isInstalledByDependency}}
-              {{^isInstalled}}
-              {{^isInstalledByDependency}}
-              <button class="install-btn" onclick="installPackage('{{name}}', '{{version}}', this)">
-                npm install
-              </button>
-              <div class="message" id="msg-{{name}}"></div>
-              {{/isInstalledByDependency}}
-              {{/isInstalled}}
-            </div>
-          </div>
-        </div>
-        {{/peerDeps}}
-        {{^peerDeps}}
-        <div class="no-deps">
-          No peer dependencies found!
-        </div>
-        {{/peerDeps}}
-      </div>
-    </div>
-    
-    <script>
-      async function installPackage(packageName, version, button) {
-        const messageEl = document.getElementById('msg-' + packageName);
-        
-        button.disabled = true;
-        button.textContent = 'Installing...';
-        messageEl.className = 'message';
-        messageEl.textContent = '';
-        
-        try {
-          const response = await fetch('/install', {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              package: packageName,
-              version: version
-            })
-          });
-          
-          const result = await response.json();
-          
-          if (result.success) {
-            messageEl.className = 'message success';
-            messageEl.textContent = result.message;
-            button.style.display = 'none';
-            
-            // Optionally reload after a delay
-            setTimeout(() => {
-              location.reload();
-            }, 2000);
-          } else {
-            messageEl.className = 'message error';
-            messageEl.textContent = result.message;
-            button.disabled = false;
-            button.textContent = 'npm install';
-          }
-        } catch (error) {
-          messageEl.className = 'message error';
-          messageEl.textContent = 'Failed to install package: ' + error.message;
-          button.disabled = false;
-          button.textContent = 'npm install';
-        }
-      }
-    </script>
-  </body>
-</html>
-`;
-}
-function getTemplate() {
-    return `
-<html>
-  <head>
-    <title>{{name}}'s Dependency Graph</title>
-    <script src="https://cdnjs.cloudflare.com/ajax/libs/sigma.js/2.4.0/sigma.min.js"></script>
-    <script src="https://cdnjs.cloudflare.com/ajax/libs/graphology/0.25.4/graphology.umd.min.js"></script>
-    <script type="text/javascript">
-        function applyForceLayout(graph, iterations) {
-            var nodes = graph.nodes();
-            var edges = graph.edges();
-            
-            // Physics constants - lower repulsion for better spacing
-            var repulsionStrength = 50;
-            var attractionStrength = 0.01;
-            var damping = 0.5;
-            
-            for (var iter = 0; iter < iterations; iter++) {
-                var forces = {};
-                
-                // Initialize forces
-                nodes.forEach(function(nodeId) {
-                    forces[nodeId] = { x: 0, y: 0 };
-                });
-                
-                // Repulsive forces between all nodes
-                for (var i = 0; i < nodes.length; i++) {
-                    for (var j = i + 1; j < nodes.length; j++) {
-                        var node1 = nodes[i];
-                        var node2 = nodes[j];
-                        var attrs1 = graph.getNodeAttributes(node1);
-                        var attrs2 = graph.getNodeAttributes(node2);
-                        
-                        var dx = attrs2.x - attrs1.x;
-                        var dy = attrs2.y - attrs1.y;
-                        var distance = Math.sqrt(dx * dx + dy * dy) || 0.1;
-                        var force = repulsionStrength / (distance * distance);
-                        
-                        var fx = (dx / distance) * force;
-                        var fy = (dy / distance) * force;
-                        
-                        forces[node1].x -= fx;
-                        forces[node1].y -= fy;
-                        forces[node2].x += fx;
-                        forces[node2].y += fy;
+// ─── Security Scan Logic ────────────────────────────────────────────
+async function runSecurityScanMode(port, shouldOpenBrowser) {
+    console.log('Running security scan...\n');
+    const findings = [];
+    const nodeModulesPath = path.join(process.cwd(), 'node_modules');
+    // Phase 1: Scan node_modules against known malicious packages
+    if (fs.existsSync(nodeModulesPath)) {
+        const entries = fs.readdirSync(nodeModulesPath);
+        for (const entry of entries) {
+            // Handle scoped packages (@scope/name)
+            if (entry.startsWith('@')) {
+                const scopePath = path.join(nodeModulesPath, entry);
+                try {
+                    const scopedEntries = fs.readdirSync(scopePath);
+                    for (const scopedEntry of scopedEntries) {
+                        const fullName = `${entry}/${scopedEntry}`;
+                        checkPackageAgainstDatabase(nodeModulesPath, fullName, findings);
                     }
                 }
-                
-                // Attractive forces along edges
-                edges.forEach(function(edgeId) {
-                    var edge = graph.extremities(edgeId);
-                    var source = edge.source || edge[0];
-                    var target = edge.target || edge[1];
-                    var attrs1 = graph.getNodeAttributes(source);
-                    var attrs2 = graph.getNodeAttributes(target);
-                    
-                    var dx = attrs2.x - attrs1.x;
-                    var dy = attrs2.y - attrs1.y;
-                    var distance = Math.sqrt(dx * dx + dy * dy) || 0.1;
-                    
-                    var fx = dx * attractionStrength;
-                    var fy = dy * attractionStrength;
-                    
-                    forces[source].x += fx;
-                    forces[source].y += fy;
-                    forces[target].x -= fx;
-                    forces[target].y -= fy;
-                });
-                
-                // Apply forces with damping
-                nodes.forEach(function(nodeId) {
-                    var attrs = graph.getNodeAttributes(nodeId);
-                    attrs.x += forces[nodeId].x * damping;
-                    attrs.y += forces[nodeId].y * damping;
-                });
+                catch {
+                    // Skip unreadable scope directories
+                }
+                continue;
             }
+            checkPackageAgainstDatabase(nodeModulesPath, entry, findings);
         }
-    
-        function renderGraph() {
-            var nodes = {{{nodes}}};
-            var edges = {{{edges}}};
-            
-            var graph = new graphology.Graph();
-            
-            nodes.forEach(function(node) {
-                graph.addNode(node.key, {
-                    label: node.label,
-                    x: node.x,
-                    y: node.y,
-                    size: node.size,
-                    color: node.color
-                });
-            });
-            
-            edges.forEach(function(edge, index) {
-                graph.mergeEdge(edge.source, edge.target, {
-                    size: 2,
-                    color: '#94a3b8'
+    }
+    else {
+        console.warn('Warning: node_modules directory not found. Skipping local package scan.\n');
+    }
+    // Phase 2: Run npm audit
+    console.log('Running npm audit...');
+    const auditResult = shell.exec('npm audit --json', {
+        windowsHide: true,
+        silent: true,
+    });
+    if (auditResult.code !== 0 && auditResult.stdout.trim() === '') {
+        console.warn('Warning: npm audit failed (missing package-lock.json or no network). Showing known-malicious results only.\n');
+    }
+    else {
+        try {
+            const auditData = JSON.parse(auditResult.stdout);
+            const vulnerabilities = auditData.vulnerabilities ?? {};
+            for (const [pkgName, vulnInfo] of Object.entries(vulnerabilities)) {
+                // Skip if already flagged by our known-malicious list
+                if (findings.some((f) => f.name === pkgName))
+                    continue;
+                const severity = vulnInfo.severity ?? 'moderate';
+                const via = Array.isArray(vulnInfo.via)
+                    ? vulnInfo.via
+                        .map((v) => (typeof v === 'string' ? v : (v.title ?? v.name ?? '')))
+                        .filter(Boolean)
+                        .join('; ')
+                    : String(vulnInfo.via ?? '');
+                const installedVer = vulnInfo.range ?? vulnInfo.version ?? 'unknown';
+                findings.push({
+                    name: pkgName,
+                    installedVersion: installedVer,
+                    severity: severity,
+                    source: 'npm-audit',
+                    description: via || `Vulnerability reported by npm audit (${severity})`,
                 });
+            }
+        }
+        catch {
+            console.warn('Warning: Could not parse npm audit output.\n');
+        }
+    }
+    // Sort findings: critical first, then high, moderate, low
+    const severityOrder = { critical: 0, high: 1, moderate: 2, low: 3 };
+    findings.sort((a, b) => severityOrder[a.severity] - severityOrder[b.severity]);
+    // Phase 3: Terminal output
+    printSecurityScanResults(findings);
+    // Phase 4: Serve HTML report
+    const packageJsonPath = path.join(process.cwd(), 'package.json');
+    let projectName = 'Unknown Project';
+    try {
+        const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
+        projectName = packageJson.name ?? projectName;
+    }
+    catch {
+        // Ignore
+    }
+    const criticalCount = findings.filter((f) => f.severity === 'critical').length;
+    const highCount = findings.filter((f) => f.severity === 'high').length;
+    const moderateCount = findings.filter((f) => f.severity === 'moderate').length;
+    const lowCount = findings.filter((f) => f.severity === 'low').length;
+    const data = {
+        projectName,
+        findings,
+        totalCount: findings.length,
+        criticalCount,
+        highCount,
+        moderateCount,
+        lowCount,
+        hasCritical: criticalCount > 0,
+        hasHigh: highCount > 0,
+        hasModerate: moderateCount > 0,
+        hasLow: lowCount > 0,
+        hasFindings: findings.length > 0,
+    };
+    const html = mustache.render(getSecurityScanTemplate(), data);
+    const app = fastify({ logger: false });
+    app.get('/', (_req, resp) => resp.type('text/html').send(html));
+    app.listen({ port }, (err, address) => {
+        if (err)
+            throw err;
+        console.log(`\nSecurity report available at: ${address}`);
+        if (shouldOpenBrowser)
+            open(address);
+    });
+}
+function checkPackageAgainstDatabase(nodeModulesPath, packageName, findings) {
+    const pkgJsonPath = path.join(nodeModulesPath, packageName, 'package.json');
+    if (!fs.existsSync(pkgJsonPath))
+        return;
+    let installedVersion;
+    try {
+        const pkgJson = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8'));
+        installedVersion = pkgJson.version ?? '0.0.0';
+    }
+    catch {
+        return;
+    }
+    for (const entry of knownMaliciousPackages) {
+        if (entry.name !== packageName)
+            continue;
+        if (entry.badVersions === '*') {
+            findings.push({
+                name: packageName,
+                installedVersion,
+                severity: entry.severity,
+                source: 'known-malicious',
+                description: entry.description,
             });
-            
-            // Apply custom force-directed layout
-            {{#applyForceLayout}}
-            applyForceLayout(graph, 100);
-            {{/applyForceLayout}}
-            
-            var container = document.getElementById("dep-graph");
-            var renderer = new Sigma(graph, container, {
-                renderEdgeLabels: false,
-                defaultNodeColor: '#3b82f6',
-                defaultEdgeColor: '#94a3b8'
+        }
+        else if (entry.badVersions.includes(installedVersion)) {
+            findings.push({
+                name: packageName,
+                installedVersion,
+                severity: entry.severity,
+                source: 'known-malicious',
+                description: entry.description,
             });
         }
-    </script>
-    <style>
-        body { margin: 0; padding: 0; }
-        #dep-graph { width: 100vw; height: 100vh; background: #f8fafc; }
-    </style>
-  </head>
-  <body onload="renderGraph()">
-    <div id="dep-graph"></div>
-  </body>
-</html>
+    }
+}
+function printSecurityScanResults(findings) {
+    if (findings.length === 0) {
+        console.log('\x1b[32m✔ No known malicious packages or vulnerabilities found.\x1b[0m\n');
+        return;
+    }
+    const critical = findings.filter((f) => f.severity === 'critical');
+    const high = findings.filter((f) => f.severity === 'high');
+    const moderate = findings.filter((f) => f.severity === 'moderate');
+    const low = findings.filter((f) => f.severity === 'low');
+    console.log(`\x1b[1mSecurity Scan Results:\x1b[0m`);
+    console.log(`─────────────────────────────────────────────`);
+    if (critical.length > 0)
+        console.log(`  \x1b[31m● ${critical.length} critical\x1b[0m`);
+    if (high.length > 0)
+        console.log(`  \x1b[33m● ${high.length} high\x1b[0m`);
+    if (moderate.length > 0)
+        console.log(`  \x1b[36m● ${moderate.length} moderate\x1b[0m`);
+    if (low.length > 0)
+        console.log(`  \x1b[37m● ${low.length} low\x1b[0m`);
+    console.log(`─────────────────────────────────────────────\n`);
+    for (const finding of findings) {
+        const color = finding.severity === 'critical'
+            ? '\x1b[31m'
+            : finding.severity === 'high'
+                ? '\x1b[33m'
+                : finding.severity === 'moderate'
+                    ? '\x1b[36m'
+                    : '\x1b[37m';
+        const sourceTag = finding.source === 'known-malicious' ? '[KNOWN MALICIOUS]' : '[npm audit]';
+        console.log(`  ${color}${finding.severity.toUpperCase()}\x1b[0m  ${finding.name}@${finding.installedVersion}  ${sourceTag}`);
+        console.log(`         ${finding.description}`);
+        console.log();
+    }
+}
+// ─── Security Scan HTML Template ────────────────────────────────────
+function getSecurityScanTemplate() {
+    return `
+<html>
+  <head>
+    <title>{{projectName}} - Security Scan</title>
+    <style>
+      * { margin: 0; padding: 0; box-sizing: border-box; }
+
+      body {
+        font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
+        background: linear-gradient(135deg, #1a1a2e 0%, #16213e 50%, #0f3460 100%);
+        min-height: 100vh;
+        padding: 2rem;
+        color: #e2e8f0;
+      }
+
+      .container { max-width: 1200px; margin: 0 auto; }
+
+      h1 {
+        color: white;
+        margin-bottom: 0.5rem;
+        font-size: 2.5rem;
+        text-align: center;
+        text-shadow: 2px 2px 4px rgba(0,0,0,0.3);
+      }
+
+      .subtitle {
+        text-align: center;
+        color: #94a3b8;
+        margin-bottom: 2rem;
+        font-size: 1.1rem;
+      }
+
+      .summary-cards {
+        display: flex;
+        gap: 1rem;
+        margin-bottom: 2rem;
+        flex-wrap: wrap;
+        justify-content: center;
+      }
+
+      .summary-card {
+        padding: 1.25rem 2rem;
+        border-radius: 12px;
+        text-align: center;
+        min-width: 140px;
+        backdrop-filter: blur(10px);
+        border: 1px solid rgba(255,255,255,0.1);
+      }
+
+      .summary-card .count {
+        font-size: 2.5rem;
+        font-weight: 700;
+        line-height: 1;
+      }
+
+      .summary-card .label {
+        font-size: 0.8rem;
+        text-transform: uppercase;
+        letter-spacing: 0.1em;
+        margin-top: 0.5rem;
+        opacity: 0.9;
+      }
+
+      .card-critical { background: rgba(239, 68, 68, 0.2); border-color: rgba(239, 68, 68, 0.4); }
+      .card-critical .count { color: #ef4444; }
+      .card-critical .label { color: #fca5a5; }
+
+      .card-high { background: rgba(245, 158, 11, 0.2); border-color: rgba(245, 158, 11, 0.4); }
+      .card-high .count { color: #f59e0b; }
+      .card-high .label { color: #fcd34d; }
+
+      .card-moderate { background: rgba(59, 130, 246, 0.2); border-color: rgba(59, 130, 246, 0.4); }
+      .card-moderate .count { color: #3b82f6; }
+      .card-moderate .label { color: #93c5fd; }
+
+      .card-low { background: rgba(107, 114, 128, 0.2); border-color: rgba(107, 114, 128, 0.4); }
+      .card-low .count { color: #9ca3af; }
+      .card-low .label { color: #d1d5db; }
+
+      .findings-list {
+        background: rgba(255, 255, 255, 0.05);
+        border-radius: 12px;
+        border: 1px solid rgba(255,255,255,0.1);
+        overflow: hidden;
+        backdrop-filter: blur(10px);
+      }
+
+      .finding-item {
+        padding: 1.25rem 1.5rem;
+        border-bottom: 1px solid rgba(255,255,255,0.06);
+        transition: background-color 0.2s;
+      }
+
+      .finding-item:last-child { border-bottom: none; }
+      .finding-item:hover { background: rgba(255,255,255,0.04); }
+
+      .finding-header {
+        display: flex;
+        align-items: center;
+        gap: 1rem;
+        margin-bottom: 0.5rem;
+        flex-wrap: wrap;
+      }
+
+      .severity-badge {
+        padding: 0.2rem 0.75rem;
+        border-radius: 9999px;
+        font-size: 0.7rem;
+        font-weight: 700;
+        text-transform: uppercase;
+        letter-spacing: 0.05em;
+      }
+
+      .severity-critical { background: #ef4444; color: white; }
+      .severity-high { background: #f59e0b; color: #1a1a2e; }
+      .severity-moderate { background: #3b82f6; color: white; }
+      .severity-low { background: #6b7280; color: white; }
+
+      .finding-name {
+        font-size: 1.2rem;
+        font-weight: 600;
+        color: #f1f5f9;
+      }
+
+      .finding-version {
+        font-family: 'Courier New', monospace;
+        font-size: 0.85rem;
+        padding: 0.15rem 0.6rem;
+        background: rgba(255,255,255,0.1);
+        border-radius: 4px;
+        color: #cbd5e1;
+      }
+
+      .source-tag {
+        font-size: 0.7rem;
+        padding: 0.15rem 0.6rem;
+        border-radius: 4px;
+        font-weight: 600;
+        text-transform: uppercase;
+        letter-spacing: 0.05em;
+      }
+
+      .source-known-malicious { background: rgba(239, 68, 68, 0.2); color: #fca5a5; border: 1px solid rgba(239, 68, 68, 0.3); }
+      .source-npm-audit { background: rgba(139, 92, 246, 0.2); color: #c4b5fd; border: 1px solid rgba(139, 92, 246, 0.3); }
+
+      .finding-description {
+        color: #94a3b8;
+        font-size: 0.9rem;
+        line-height: 1.5;
+        padding-left: 0.25rem;
+      }
+
+      .no-findings {
+        padding: 4rem 2rem;
+        text-align: center;
+      }
+
+      .no-findings .checkmark {
+        font-size: 4rem;
+        margin-bottom: 1rem;
+      }
+
+      .no-findings h2 {
+        color: #22c55e;
+        font-size: 1.5rem;
+        margin-bottom: 0.5rem;
+      }
+
+      .no-findings p {
+        color: #94a3b8;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="container">
+      <h1>Security Scan</h1>
+      <p class="subtitle">{{projectName}}</p>
+
+      {{#hasFindings}}
+      <div class="summary-cards">
+        {{#hasCritical}}
+        <div class="summary-card card-critical">
+          <div class="count">{{criticalCount}}</div>
+          <div class="label">Critical</div>
+        </div>
+        {{/hasCritical}}
+        {{#hasHigh}}
+        <div class="summary-card card-high">
+          <div class="count">{{highCount}}</div>
+          <div class="label">High</div>
+        </div>
+        {{/hasHigh}}
+        {{#hasModerate}}
+        <div class="summary-card card-moderate">
+          <div class="count">{{moderateCount}}</div>
+          <div class="label">Moderate</div>
+        </div>
+        {{/hasModerate}}
+        {{#hasLow}}
+        <div class="summary-card card-low">
+          <div class="count">{{lowCount}}</div>
+          <div class="label">Low</div>
+        </div>
+        {{/hasLow}}
+      </div>
+
+      <div class="findings-list">
+        {{#findings}}
+        <div class="finding-item">
+          <div class="finding-header">
+            <span class="severity-badge severity-{{severity}}">{{severity}}</span>
+            <span class="finding-name">{{name}}</span>
+            <span class="finding-version">{{installedVersion}}</span>
+            <span class="source-tag source-{{source}}">{{source}}</span>
+          </div>
+          <div class="finding-description">{{description}}</div>
+        </div>
+        {{/findings}}
+      </div>
+      {{/hasFindings}}
+
+      {{^hasFindings}}
+      <div class="findings-list">
+        <div class="no-findings">
+          <div class="checkmark">&#10003;</div>
+          <h2>All Clear</h2>
+          <p>No known malicious packages or vulnerabilities were found.</p>
+        </div>
+      </div>
+      {{/hasFindings}}
+    </div>
+  </body>
+</html>
+`;
+}
+function getPeerDepsTemplate() {
+    return `
+<html>
+  <head>
+    <title>{{projectName}} - Peer Dependencies</title>
+    <style>
+      * {
+        margin: 0;
+        padding: 0;
+        box-sizing: border-box;
+      }
+      
+      body {
+        font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
+        background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+        min-height: 100vh;
+        padding: 2rem;
+      }
+      
+      .container {
+        max-width: 1200px;
+        margin: 0 auto;
+      }
+      
+      h1 {
+        color: white;
+        margin-bottom: 2rem;
+        font-size: 2.5rem;
+        text-align: center;
+        text-shadow: 2px 2px 4px rgba(0,0,0,0.2);
+      }
+      
+      .peer-deps-list {
+        background: white;
+        border-radius: 12px;
+        box-shadow: 0 10px 40px rgba(0,0,0,0.1);
+        overflow: hidden;
+      }
+      
+      .peer-dep-item {
+        padding: 1.5rem;
+        border-bottom: 1px solid #e5e7eb;
+        transition: background-color 0.2s;
+      }
+      
+      .peer-dep-item:last-child {
+        border-bottom: none;
+      }
+      
+      .peer-dep-item:hover {
+        background-color: #f9fafb;
+      }
+      
+      .peer-dep-header {
+        display: flex;
+        justify-content: space-between;
+        align-items: center;
+        margin-bottom: 0.75rem;
+      }
+      
+      .peer-dep-name {
+        font-size: 1.25rem;
+        font-weight: 600;
+        color: #1f2937;
+      }
+      
+      .peer-dep-version {
+        font-family: 'Courier New', monospace;
+        padding: 0.25rem 0.75rem;
+        background: #f3f4f6;
+        border-radius: 6px;
+        font-size: 0.875rem;
+        color: #4b5563;
+      }
+      
+      .peer-dep-version.conflict {
+        background: #fee2e2;
+        color: #dc2626;
+        font-weight: 600;
+      }
+      
+      .peer-dep-info {
+        display: flex;
+        justify-content: space-between;
+        align-items: center;
+        flex-wrap: wrap;
+        gap: 1rem;
+      }
+      
+      .required-by {
+        flex: 1;
+        min-width: 200px;
+      }
+      
+      .required-by-label {
+        font-size: 0.75rem;
+        color: #6b7280;
+        text-transform: uppercase;
+        letter-spacing: 0.05em;
+        margin-bottom: 0.25rem;
+      }
+      
+      .required-by-list {
+        display: flex;
+        flex-wrap: wrap;
+        gap: 0.5rem;
+      }
+      
+      .required-by-tag {
+        display: inline-block;
+        padding: 0.25rem 0.5rem;
+        background: #dbeafe;
+        color: #1e40af;
+        border-radius: 4px;
+        font-size: 0.75rem;
+        font-weight: 500;
+      }
+      
+      .install-btn {
+        padding: 0.5rem 1.5rem;
+        background: #3b82f6;
+        color: white;
+        border: none;
+        border-radius: 6px;
+        font-size: 0.875rem;
+        font-weight: 500;
+        cursor: pointer;
+        transition: all 0.2s;
+        box-shadow: 0 2px 4px rgba(59, 130, 246, 0.3);
+      }
+      
+      .install-btn:hover {
+        background: #2563eb;
+        transform: translateY(-1px);
+        box-shadow: 0 4px 8px rgba(59, 130, 246, 0.4);
+      }
+      
+      .install-btn:active {
+        transform: translateY(0);
+      }
+      
+      .install-btn:disabled {
+        background: #9ca3af;
+        cursor: not-allowed;
+        transform: none;
+        box-shadow: none;
+      }
+      
+      .installed-badge {
+        display: flex;
+        align-items: center;
+        gap: 0.5rem;
+        padding: 0.5rem 1rem;
+        background: #d1fae5;
+        color: #065f46;
+        border-radius: 6px;
+        font-size: 0.875rem;
+        font-weight: 600;
+      }
+      
+      .installed-by-dep-badge {
+        display: flex;
+        align-items: center;
+        gap: 0.5rem;
+        padding: 0.5rem 1rem;
+        background: #e0e7ff;
+        color: #3730a3;
+        border-radius: 6px;
+        font-size: 0.875rem;
+        font-weight: 600;
+      }
+      
+      .checkmark {
+        color: #10b981;
+        font-size: 1.25rem;
+      }
+      
+      .message {
+        margin-top: 0.5rem;
+        padding: 0.5rem;
+        border-radius: 4px;
+        font-size: 0.875rem;
+        display: none;
+      }
+      
+      .message.success {
+        background: #d1fae5;
+        color: #065f46;
+        display: block;
+      }
+      
+      .message.error {
+        background: #fee2e2;
+        color: #dc2626;
+        display: block;
+      }
+
+      .no-deps {
+        padding: 3rem;
+        text-align: center;
+        color: #6b7280;
+        font-size: 1.125rem;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="container">
+      <h1>Peer Dependencies for {{projectName}}</h1>
+      <div class="peer-deps-list">
+        {{#peerDeps}}
+        <div class="peer-dep-item">
+          <div class="peer-dep-header">
+            <span class="peer-dep-name">{{name}}</span>
+            <span class="peer-dep-version {{#isConflict}}conflict{{/isConflict}}">
+              {{#isConflict}}Conflict: {{/isConflict}}{{version}}
+            </span>
+          </div>
+          <div class="peer-dep-info">
+            <div class="required-by">
+              <div class="required-by-label">Required by:</div>
+              <div class="required-by-list">
+                {{#requiredBy}}
+                <span class="required-by-tag">{{.}}</span>
+                {{/requiredBy}}
+              </div>
+            </div>
+            <div class="action-container">
+              {{#isInstalled}}
+              <div class="installed-badge">
+                Installed
+              </div>
+              {{/isInstalled}}
+              {{#isInstalledByDependency}}
+              <div class="installed-by-dep-badge">
+                Installed by dependency
+              </div>
+              {{/isInstalledByDependency}}
+              {{^isInstalled}}
+              {{^isInstalledByDependency}}
+              <button class="install-btn" onclick="installPackage('{{name}}', '{{version}}', this)">
+                npm install
+              </button>
+              <div class="message" id="msg-{{name}}"></div>
+              {{/isInstalledByDependency}}
+              {{/isInstalled}}
+            </div>
+          </div>
+        </div>
+        {{/peerDeps}}
+        {{^peerDeps}}
+        <div class="no-deps">
+          No peer dependencies found!
+        </div>
+        {{/peerDeps}}
+      </div>
+    </div>
+    
+    <script>
+      async function installPackage(packageName, version, button) {
+        const messageEl = document.getElementById('msg-' + packageName);
+        
+        button.disabled = true;
+        button.textContent = 'Installing...';
+        messageEl.className = 'message';
+        messageEl.textContent = '';
+        
+        try {
+          const response = await fetch('/install', {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              package: packageName,
+              version: version
+            })
+          });
+          
+          const result = await response.json();
+          
+          if (result.success) {
+            messageEl.className = 'message success';
+            messageEl.textContent = result.message;
+            button.style.display = 'none';
+            
+            // Optionally reload after a delay
+            setTimeout(() => {
+              location.reload();
+            }, 2000);
+          } else {
+            messageEl.className = 'message error';
+            messageEl.textContent = result.message;
+            button.disabled = false;
+            button.textContent = 'npm install';
+          }
+        } catch (error) {
+          messageEl.className = 'message error';
+          messageEl.textContent = 'Failed to install package: ' + error.message;
+          button.disabled = false;
+          button.textContent = 'npm install';
+        }
+      }
+    </script>
+  </body>
+</html>
+`;
+}
+function getTemplate() {
+    return `
+<html>
+  <head>
+    <title>{{name}}'s Dependency Graph</title>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/sigma.js/2.4.0/sigma.min.js"></script>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/graphology/0.25.4/graphology.umd.min.js"></script>
+    <script type="text/javascript">
+        function applyForceLayout(graph, iterations) {
+            var nodes = graph.nodes();
+            var edges = graph.edges();
+            
+            // Physics constants - lower repulsion for better spacing
+            var repulsionStrength = 50;
+            var attractionStrength = 0.01;
+            var damping = 0.5;
+            
+            for (var iter = 0; iter < iterations; iter++) {
+                var forces = {};
+                
+                // Initialize forces
+                nodes.forEach(function(nodeId) {
+                    forces[nodeId] = { x: 0, y: 0 };
+                });
+                
+                // Repulsive forces between all nodes
+                for (var i = 0; i < nodes.length; i++) {
+                    for (var j = i + 1; j < nodes.length; j++) {
+                        var node1 = nodes[i];
+                        var node2 = nodes[j];
+                        var attrs1 = graph.getNodeAttributes(node1);
+                        var attrs2 = graph.getNodeAttributes(node2);
+                        
+                        var dx = attrs2.x - attrs1.x;
+                        var dy = attrs2.y - attrs1.y;
+                        var distance = Math.sqrt(dx * dx + dy * dy) || 0.1;
+                        var force = repulsionStrength / (distance * distance);
+                        
+                        var fx = (dx / distance) * force;
+                        var fy = (dy / distance) * force;
+                        
+                        forces[node1].x -= fx;
+                        forces[node1].y -= fy;
+                        forces[node2].x += fx;
+                        forces[node2].y += fy;
+                    }
+                }
+                
+                // Attractive forces along edges
+                edges.forEach(function(edgeId) {
+                    var edge = graph.extremities(edgeId);
+                    var source = edge.source || edge[0];
+                    var target = edge.target || edge[1];
+                    var attrs1 = graph.getNodeAttributes(source);
+                    var attrs2 = graph.getNodeAttributes(target);
+                    
+                    var dx = attrs2.x - attrs1.x;
+                    var dy = attrs2.y - attrs1.y;
+                    var distance = Math.sqrt(dx * dx + dy * dy) || 0.1;
+                    
+                    var fx = dx * attractionStrength;
+                    var fy = dy * attractionStrength;
+                    
+                    forces[source].x += fx;
+                    forces[source].y += fy;
+                    forces[target].x -= fx;
+                    forces[target].y -= fy;
+                });
+                
+                // Apply forces with damping
+                nodes.forEach(function(nodeId) {
+                    var attrs = graph.getNodeAttributes(nodeId);
+                    attrs.x += forces[nodeId].x * damping;
+                    attrs.y += forces[nodeId].y * damping;
+                });
+            }
+        }
+    
+        function renderGraph() {
+            var nodes = {{{nodes}}};
+            var edges = {{{edges}}};
+            
+            var graph = new graphology.Graph();
+            
+            nodes.forEach(function(node) {
+                graph.addNode(node.key, {
+                    label: node.label,
+                    x: node.x,
+                    y: node.y,
+                    size: node.size,
+                    color: node.color
+                });
+            });
+            
+            edges.forEach(function(edge, index) {
+                graph.mergeEdge(edge.source, edge.target, {
+                    size: 2,
+                    color: '#94a3b8'
+                });
+            });
+            
+            // Apply custom force-directed layout
+            {{#applyForceLayout}}
+            applyForceLayout(graph, 100);
+            {{/applyForceLayout}}
+            
+            var container = document.getElementById("dep-graph");
+            var renderer = new Sigma(graph, container, {
+                renderEdgeLabels: false,
+                defaultNodeColor: '#3b82f6',
+                defaultEdgeColor: '#94a3b8'
+            });
+        }
+    </script>
+    <style>
+        body { margin: 0; padding: 0; }
+        #dep-graph { width: 100vw; height: 100vh; background: #f8fafc; }
+    </style>
+  </head>
+  <body onload="renderGraph()">
+    <div id="dep-graph"></div>
+  </body>
+</html>
 `;
 }