fad-checker 1.0.0 → 1.0.1

package/CLAUDE.md

@@ -4,7 +4,7 @@ Code-level orientation for contributors and Claude Code sessions on this repo.
 
 ## What this is
 
-`fad-check` — **Fucking Autonomous Dependency Checker**. Node.js CLI (`fad-check`, or short alias `fad`) that:
+`fad-checker` — **Fucking Autonomous Dependency Checker**. Node.js CLI (`fad-checker`, or short alias `fad`) that:
 
 1. Walks a multi-module Maven tree, removes private/excluded dependencies (regex on groupId), writes a parallel directory of "cleaned" POMs that can be fed to Snyk.
 2. Walks every JS package (`package.json` + `package-lock.json` v1/v2/v3 or `yarn.lock` v1) in the same source tree.
@@ -27,9 +27,9 @@ npm install
 npm test                  # 96 unit tests via node --test
 
 # basic cleanup workflow
-node fad-check.js -s ./proj                                        # read-only, full report
-node fad-check.js -s ./proj -t ../pom-clean -e "^client\\."        # write cleaned tree
-node fad-check.js -s ./proj -t ../pom-clean -e "^client\\." --snyk # also drive snyk
+node fad-checker.js -s ./proj                                        # read-only, full report
+node fad-checker.js -s ./proj -t ../pom-clean -e "^client\\."        # write cleaned tree
+node fad-checker.js -s ./proj -t ../pom-clean -e "^client\\." --snyk # also drive snyk
 
 # read the full usage doc
 cat docs/USAGE.md
@@ -38,8 +38,8 @@ cat docs/USAGE.md
 Binary builds (requires `bun`):
 
 ```bash
-npm run build:linux   # → dist/fad-check-linux
-npm run build:win     # → dist/fad-check.exe
+npm run build:linux   # → dist/fad-checker-linux
+npm run build:win     # → dist/fad-checker.exe
 npm run build         # both
 ```
 
@@ -51,7 +51,7 @@ Guardrails enforced at startup:
 ## Architecture (one-liner per file)
 
 ```
-fad-check.js                 Thin CLI: commander parsing, orchestration only.
+fad-checker.js                 Thin CLI: commander parsing, orchestration only.
 lib/core.js                  POM parsing, parent resolution, all-profile merge, rewrite.
 lib/maven-version.js         Maven version parsing + range comparison (no external deps).
 lib/cve-download.js          Bulk download of CVEProject/cvelistV5 + Maven-relevant index build.
@@ -64,13 +64,13 @@ lib/osv.js                   OSV.dev batched query + per-vuln detail fetch.
 lib/nvd.js                   NIST NVD enrichment (CVSS, references, CPE configurations).
 lib/snyk.js                  `snyk test --all-projects --json` runner + merge.
 lib/retire.js                retire.js (vendored-JS scanner) wrapper + cache + normaliser.
-lib/scan-completeness.js     Warnings for deps fad-check couldn't fully resolve.
+lib/scan-completeness.js     Warnings for deps fad-checker couldn't fully resolve.
 lib/npm/parse.js             package.json, package-lock.json (v1/2/3), yarn.lock v1 parsers.
 lib/npm/collect.js           Merge across JS manifests → unified resolvedDeps Map.
-lib/cache-archive.js         tar.gz / zip export & import of ~/.fad-check/.
-lib/config.js                Persistent user config in ~/.fad-check/config.json (mode 0600).
+lib/cache-archive.js         tar.gz / zip export & import of ~/.fad-checker/.
+lib/config.js                Persistent user config in ~/.fad-checker/config.json (mode 0600).
 data/                        known-obsolete.json, eol-mapping.json, cpe-coord-map.json, known-public-namespaces.json
-completions/                 fad-check.bash, fad-check.zsh
+completions/                 fad-checker.bash, fad-checker.zsh
 test/                        node:test suite + fixtures (simple, complex-enterprise, monorepo-mixed, …).
 ```
 
@@ -104,8 +104,8 @@ Test fixtures live in `test/fixtures/`:
 ## Gotchas / edge cases worth knowing
 
 - CVE bundle from CVEProject is ~500 MB unpacked. Shells out to `curl + unzip` (fallback to `fetch()` + `unzip` / `Expand-Archive`). Extracted JSON deleted after index build. Ships as `cves.zip.zip` (nested zip) — `extractZip()` recurses up to 3 levels.
-- `endoflife.date` API responses cached 7 days; Maven Central version lookups cached 24 hours. Cache lives in `~/.fad-check/`.
-- **Persistent config**: `~/.fad-check/config.json` (mode 0600). Set NVD key via `fad-check --set-nvd-key <KEY>` (free, instant from <https://nvd.nist.gov/developers/request-an-api-key> — bumps rate limit from 5/30s to 50/30s).
+- `endoflife.date` API responses cached 7 days; Maven Central version lookups cached 24 hours. Cache lives in `~/.fad-checker/`.
+- **Persistent config**: `~/.fad-checker/config.json` (mode 0600). Set NVD key via `fad-checker --set-nvd-key <KEY>` (free, instant from <https://nvd.nist.gov/developers/request-an-api-key> — bumps rate limit from 5/30s to 50/30s).
 - **`--offline` umbrella flag**: skips every network call (CVE/OSV/NVD/Maven Central/endoflife/retire). Falls back to whatever is already cached. Per-source variants (`--cve-offline`, `--no-osv`, `--no-nvd`, `--no-retire`, `--no-transitive`) still work independently.
 - `snyk` is not a hard dep — shells out via `execFile`. `snyk` exits 1 on findings; the JSON is still on stdout.
 - The cleaned POM is the union of every profile's deps. Counts will be larger than the source POM. Intentional — don't "fix" that.
@@ -116,11 +116,11 @@ Test fixtures live in `test/fixtures/`:
 
 | Cache | Location | TTL |
 |---|---|---|
-| CVEProject bulk index | `~/.fad-check/cve-data/maven-cve-index.json` | 24 h |
-| OSV per-dep stub list | `~/.fad-check/osv-cache/<eco>__<g>__<a>__<v>.json` | 12 h |
-| OSV vuln details | `~/.fad-check/osv-cache/vuln_<id>.json` | 12 h |
-| NVD CVE record | `~/.fad-check/nvd-cache/<cveId>.json` | 7 d |
-| endoflife.date cycles | `~/.fad-check/eol-cache.json` | 7 d |
-| Maven Central latest | `~/.fad-check/version-cache.json` | 24 h |
-| Transitive POM | `~/.fad-check/poms-cache/<g>__<a>__<v>.pom` | ∞ (immutable on Maven Central) |
-| retire.js findings | `~/.fad-check/retire-cache/<md5(src)>.json` | 24 h |
+| CVEProject bulk index | `~/.fad-checker/cve-data/maven-cve-index.json` | 24 h |
+| OSV per-dep stub list | `~/.fad-checker/osv-cache/<eco>__<g>__<a>__<v>.json` | 12 h |
+| OSV vuln details | `~/.fad-checker/osv-cache/vuln_<id>.json` | 12 h |
+| NVD CVE record | `~/.fad-checker/nvd-cache/<cveId>.json` | 7 d |
+| endoflife.date cycles | `~/.fad-checker/eol-cache.json` | 7 d |
+| Maven Central latest | `~/.fad-checker/version-cache.json` | 24 h |
+| Transitive POM | `~/.fad-checker/poms-cache/<g>__<a>__<v>.pom` | ∞ (immutable on Maven Central) |
+| retire.js findings | `~/.fad-checker/retire-cache/<md5(src)>.json` | 24 h |

package/README.md

@@ -1,8 +1,8 @@
-# fad-check
+# fad-checker
 
 > **F**ucking **A**utonomous **D**ependency **C**hecker
 
-`fad-check` scans **Maven**, **npm**, **Yarn** and **vendored JavaScript** in any source tree — multi-module, monorepo, polyglot, whatever you've got — and produces a single self-contained HTML report with CVE, EOL, obsolete and outdated findings, plus per-ecosystem fix recipes.
+`fad-checker` scans **Maven**, **npm**, **Yarn** and **vendored JavaScript** in any source tree — multi-module, monorepo, polyglot, whatever you've got — and produces a single self-contained HTML report with CVE, EOL, obsolete and outdated findings, plus per-ecosystem fix recipes.
 
 It runs against the source files alone. **No `mvn`, no `npm install`, no `yarn`, no Docker.** It reads `pom.xml`, `package-lock.json` and `yarn.lock` directly.
 
@@ -47,16 +47,16 @@ The HTML report opens in any browser, contains every detail (CVSS vectors, refer
 ## Quick start
 
 ```bash
-npm install -g fad-check
-fad-check -s ./my-project
+npm install -g fad-checker
+fad-checker -s ./my-project
 ```
 
-That's it. The report lands in `./fad-check-report/cve-report.html`.
+That's it. The report lands in `./fad-checker-report/cve-report.html`.
 
 Want a 10× faster NVD enrichment? [Get a free NVD API key](https://nvd.nist.gov/developers/request-an-api-key) (instant), then:
 
 ```bash
-fad-check --set-nvd-key YOUR_KEY
+fad-checker --set-nvd-key YOUR_KEY
 ```
 
 ---
@@ -65,28 +65,28 @@ fad-check --set-nvd-key YOUR_KEY
 
 ```bash
 # Read-only full scan (default: all sources on)
-fad-check -s ./proj
+fad-checker -s ./proj
 
 # Exclude private/internal libs by groupId regex
-fad-check -s ./proj -e "^(com\.acme|org\.private)\."
+fad-checker -s ./proj -e "^(com\.acme|org\.private)\."
 
 # Also write cleaned POMs (private deps stripped, ready for Snyk)
-fad-check -s ./proj -t ../proj-clean -e "^com\.acme\."
+fad-checker -s ./proj -t ../proj-clean -e "^com\.acme\."
 
 # Then run Snyk on the cleaned tree and merge findings
-fad-check -s ./proj -t ../proj-clean -e "^com\.acme\." --snyk
+fad-checker -s ./proj -t ../proj-clean -e "^com\.acme\." --snyk
 
 # Faster: skip Maven Central / no transitive walk
-fad-check -s ./proj --no-all-libs --no-transitive
+fad-checker -s ./proj --no-all-libs --no-transitive
 
 # Fully offline (uses cached data only)
-fad-check -s ./proj --offline
+fad-checker -s ./proj --offline
 
 # Only one ecosystem
-fad-check -s ./proj --ecosystem maven   # or npm | both | auto (default)
+fad-checker -s ./proj --ecosystem maven   # or npm | both | auto (default)
 ```
 
-Run `fad-check --help` for the full flag list.
+Run `fad-checker --help` for the full flag list.
 
 ---
 
@@ -131,38 +131,38 @@ Each CVE row shows: severity badge · CVE / GHSA id · dep coord & version · wh
 ### As a global CLI
 
 ```bash
-npm install -g fad-check
+npm install -g fad-checker
 ```
 
 ### From source
 
 ```bash
-git clone <repo-url> fad-check
-cd fad-check
+git clone <repo-url> fad-checker
+cd fad-checker
 npm install
-node fad-check.js --help
+node fad-checker.js --help
 ```
 
 ### Single-binary build (no Node required)
 
 ```bash
 npm install        # one-time, brings in bun
-npm run build      # → dist/fad-check-linux + dist/fad-check.exe
+npm run build      # → dist/fad-checker-linux + dist/fad-checker.exe
 ```
 
 ### Shell completion
 
 ```bash
-fad-check --completion bash > /etc/bash_completion.d/fad-check
+fad-checker --completion bash > /etc/bash_completion.d/fad-checker
 # or for zsh:
-fad-check --completion zsh  > ~/.zsh/completions/_fad-check
+fad-checker --completion zsh  > ~/.zsh/completions/_fad-checker
 ```
 
 ---
 
 ## How it scans without any build tool
 
-This is the surprising bit. The whole point is that you can run `fad-check` against a *checkout* with no build environment.
+This is the surprising bit. The whole point is that you can run `fad-checker` against a *checkout* with no build environment.
 
 - **Maven** — `pom.xml` files are parsed with xml2js. Property substitution (`${jackson.version}`), parent inheritance, local BOM imports (`<scope>import</scope>`) and every profile are resolved in-process. Transitive deps are walked by fetching child POMs from Maven Central (cached forever — POMs are immutable). When the project uses an **external BOM** (`spring-boot-dependencies` etc.), the deps whose version comes from that BOM can't be resolved without `mvn` itself — those are surfaced in chapter 0 as "unresolved-versions" so you know what's missing.
 - **npm / Yarn** — `package-lock.json` (v1, v2, v3) and `yarn.lock` v1 are parsed directly. Lockfiles already contain every transitive version. No `node_modules/` traversal, no `npm install`. A package.json *without* a sibling lockfile is intentionally skipped (its ranges aren't queryable) and reported in chapter 0.
@@ -177,7 +177,7 @@ This is the surprising bit. The whole point is that you can run `fad-check` agai
 
 ## Caching
 
-All cached data lives in `~/.fad-check/`:
+All cached data lives in `~/.fad-checker/`:
 
 | Cache | Path | TTL |
 | --- | --- | --- |
@@ -194,9 +194,9 @@ All cached data lives in `~/.fad-check/`:
 Export the lot to share between machines:
 
 ```bash
-fad-check --export-cache fad-cache.tar.gz
+fad-checker --export-cache fad-cache.tar.gz
 # on the other box:
-fad-check --import-cache fad-cache.tar.gz
+fad-checker --import-cache fad-cache.tar.gz
 ```
 
 `--include-config` ships the NVD API key too (off by default).
@@ -205,19 +205,19 @@ fad-check --import-cache fad-cache.tar.gz
 
 ## Custom Maven repositories
 
-Out of the box `fad-check` queries Maven Central for transitive POMs and latest versions. If your project depends on artifacts that live on a private Nexus / Artifactory / JBoss repo, add them so transitive resolution and outdated checks work end-to-end.
+Out of the box `fad-checker` queries Maven Central for transitive POMs and latest versions. If your project depends on artifacts that live on a private Nexus / Artifactory / JBoss repo, add them so transitive resolution and outdated checks work end-to-end.
 
 ```bash
-# Persist a repo (lives in ~/.fad-check/config.json)
-fad-check --add-repo nexus       https://nexus.acme.com/repository/maven-public/
-fad-check --add-repo nexus-priv  https://nexus.acme.com/repository/maven-private/  --auth alice:s3cr3t
-fad-check --list-repos
-fad-check --remove-repo nexus-priv
+# Persist a repo (lives in ~/.fad-checker/config.json)
+fad-checker --add-repo nexus       https://nexus.acme.com/repository/maven-public/
+fad-checker --add-repo nexus-priv  https://nexus.acme.com/repository/maven-private/  --auth alice:s3cr3t
+fad-checker --list-repos
+fad-checker --remove-repo nexus-priv
 
 # One-off (not persisted) — repeatable
-fad-check -s ./proj --repo https://nexus.acme.com/repository/maven-public/
+fad-checker -s ./proj --repo https://nexus.acme.com/repository/maven-public/
 # Inline auth in the URL also works:
-fad-check -s ./proj --repo https://alice:s3cr3t@nexus.acme.com/repository/maven-public/
+fad-checker -s ./proj --repo https://alice:s3cr3t@nexus.acme.com/repository/maven-public/
 ```
 
 Repos are tried **in declared order, Maven Central last**. Auth is sent as a `Basic <base64>` header. POMs and `maven-metadata.xml` are cached per coord, so subsequent runs are free even against a private repo.
@@ -226,7 +226,7 @@ Repos are tried **in declared order, Maven Central last**. Auth is sent as a `Ba
 
 ## Data sources & acknowledgments
 
-`fad-check` is glue around several outstanding public datasets. Each is used per its license terms.
+`fad-checker` is glue around several outstanding public datasets. Each is used per its license terms.
 
 | Source | What we use | License | API / endpoint |
 | --- | --- | --- | --- |
@@ -239,7 +239,7 @@ Repos are tried **in declared order, Maven Central last**. Auth is sent as a `Ba
 | [Snyk](https://snyk.io/) (optional) | Additional CVE source via `snyk test --all-projects --json` | Per Snyk EULA; needs a Snyk account | Local CLI `snyk` |
 | [MITRE CWE](https://cwe.mitre.org/) | Weakness category links in the report | Free public reference | Linked by URL only, no API call |
 
-Persistent caches mean each source is hit at most once per its TTL (see [Caching](#caching) table). No telemetry, no third-party analytics — every request listed above is made directly to the named endpoint with a `User-Agent: fad-check-*` header.
+Persistent caches mean each source is hit at most once per its TTL (see [Caching](#caching) table). No telemetry, no third-party analytics — every request listed above is made directly to the named endpoint with a `User-Agent: fad-checker-*` header.
 
 ---
 
@@ -255,14 +255,14 @@ Built-in guardrails that fire **before** any disk write:
 
 ## Compared to…
 
-| Tool | What `fad-check` adds |
+| Tool | What `fad-checker` adds |
 | --- | --- |
 | `mvn dependency:tree` | No Maven needed; multi-source CVE scan; HTML report |
 | `npm audit` | Polyglot (Maven + npm + vendored JS in one report); EOL & obsolete checks; works without `npm install` |
 | Snyk CLI | Free; offline-capable; integrates Snyk's results if you have it |
 | OWASP DC | Faster (cached); cleaner UI; multi-source dedup |
 
-You don't have to choose — `fad-check` will use any of them as input (`--snyk`) and merge results.
+You don't have to choose — `fad-checker` will use any of them as input (`--snyk`) and merge results.
 
 ---
 

package/completions/{fad-check.bash → fad-checker.bash}

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
-# Bash completion for fad-check (Fucking Autonomous Dependency Checker)
-# Source this file or copy it to /etc/bash_completion.d/fad-check
+# Bash completion for fad-checker (Fucking Autonomous Dependency Checker)
+# Source this file or copy it to /etc/bash_completion.d/fad-checker
 _fad_check_complete() {
 	local cur prev opts
 	COMPREPLY=()
@@ -20,4 +20,4 @@ _fad_check_complete() {
 		return 0
 	fi
 }
-complete -F _fad_check_complete fad-check
+complete -F _fad_check_complete fad-checker

package/completions/{fad-check.zsh → fad-checker.zsh}

@@ -1,5 +1,5 @@
-#compdef fad-check
-# Zsh completion for fad-check (Fucking Autonomous Dependency Checker)
+#compdef fad-checker
+# Zsh completion for fad-checker (Fucking Autonomous Dependency Checker)
 _fad_check() {
 	local -a opts
 	opts=(

package/docs/ARCHITECTURE.md

@@ -1,11 +1,11 @@
 # Architecture
 
-This is the deep-dive for anyone modifying `fad-check`'s internals or wondering why a particular finding shows up the way it does. For day-to-day usage, see [`USAGE.md`](USAGE.md).
+This is the deep-dive for anyone modifying `fad-checker`'s internals or wondering why a particular finding shows up the way it does. For day-to-day usage, see [`USAGE.md`](USAGE.md).
 
 ## Module map
 
 ```
-fad-check.js                 Thin CLI: commander parsing, orchestration only.
+fad-checker.js                 Thin CLI: commander parsing, orchestration only.
 lib/core.js                  POM parsing, parent resolution, all-profile merge, rewrite.
 lib/maven-version.js         Maven version parsing + range comparison (no external deps).
 lib/cve-download.js          Bulk download of CVEProject/cvelistV5 + Maven-relevant index build.
@@ -21,10 +21,10 @@ lib/retire.js                retire.js (vendored-JS scanner) wrapper + cache + n
 lib/scan-completeness.js     Warnings for deps we couldn't fully resolve.
 lib/npm/parse.js             package.json, package-lock.json (v1/2/3), yarn.lock v1 parsers.
 lib/npm/collect.js           Merge across JS manifests → unified resolvedDeps Map.
-lib/cache-archive.js         tar.gz / zip export & import of ~/.fad-check/.
-lib/config.js                Persistent user config in ~/.fad-check/config.json (mode 0600).
+lib/cache-archive.js         tar.gz / zip export & import of ~/.fad-checker/.
+lib/config.js                Persistent user config in ~/.fad-checker/config.json (mode 0600).
 data/                        Curated JSON: known-obsolete, eol-mapping, cpe-coord-map, known-public-namespaces.
-completions/                 fad-check.bash, fad-check.zsh
+completions/                 fad-checker.bash, fad-checker.zsh
 test/                        node:test suite + fixtures (simple, complex-enterprise, monorepo-mixed, …).
 ```
 
@@ -61,11 +61,11 @@ The Maven keyspace and npm keyspace never collide — `:lodash` (Maven groupId-l
 3. `getAllInheritedProps()` — merges `<dependencies>`, `<dependencyManagement>`, `<properties>` from **every** `<profile>` (with `activeByDefault` properties winning for value conflicts), follows `<scope>import</scope>` BOMs to other local POMs, and recurses into resolved parents.
 4. `rewritePoms()` — strips everything outside `nodeToKeep`, runs `cleanDeps()` to apply the `-e` regex, rewrites the `<parent>.relativePath` and `version` to the parent's value (not the child's). Skips disk writes when `readOnly`.
 
-## Report pipeline (driven by `fad-check.js` when `--report` is set)
+## Report pipeline (driven by `fad-checker.js` when `--report` is set)
 
 1. **Collect** — `collectResolvedDeps()` dedupes by `groupId:artifactId`, keeps the highest version on conflict, includes external parent POMs as `scope='parent'`. `--ignore-test` honored. For npm, `collectNpmDeps()` walks JS manifests (lockfile-only — `package.json` without sibling lockfile is skipped + warned).
 2. **Transitive expansion** (optional, `--transitive`) — `expandWithTransitives()` walks the Maven Central POM graph honouring exclusions, root depMgmt overrides, nearest-wins on version conflict, `--transitive-depth` cap. Skips test + optional scopes by default.
-3. **CVE index** — `ensureCveIndex()` downloads the daily CVEProject zip (via `curl + unzip`, or falls back to `fetch()` + `unzip` / PowerShell `Expand-Archive`), filters to Maven-relevant entries, caches the compact index to `~/.fad-check/cve-data/maven-cve-index.json`. Fresh for 24h. `--cve-refresh` forces rebuild, `--cve-offline` uses cache only.
+3. **CVE index** — `ensureCveIndex()` downloads the daily CVEProject zip (via `curl + unzip`, or falls back to `fetch()` + `unzip` / PowerShell `Expand-Archive`), filters to Maven-relevant entries, caches the compact index to `~/.fad-checker/cve-data/maven-cve-index.json`. Fresh for 24h. `--cve-refresh` forces rebuild, `--cve-offline` uses cache only.
 4. **CVE matching** — `matchDepsAgainstCves()` runs three tiers:
    - `exact`: `byPackageName["g:a"]` hit
    - `probable`: `byProduct[artifactId]` + vendor matches groupId (`apache` ↔ `org.apache.*`)
@@ -76,13 +76,13 @@ The Maven keyspace and npm keyspace never collide — `:lodash` (Maven groupId-l
 7. **CPE refinement** — `refineMatchesWithCpe()` walks NVD's `configurations[].nodes[]` against each matched dep:
    - Confirms the dep version actually falls in the vulnerable range (else `cpeFiltered: true` — likely false positive).
    - Upgrades match `confidence` from `possible` → `probable` → `exact` when a curated `cpe-coord-map.json` entry confirms vendor:product → dep coord.
-8. **retire.js** (default on) — shells out to `retire --outputformat json --jspath <src>`. Output normalised to fad-check match shape, with the vendored file path attached so the report can show where the offending `.js` lives. Cache: `~/.fad-check/retire-cache/<md5(src)>.json`, 24h TTL.
+8. **retire.js** (default on) — shells out to `retire --outputformat json --jspath <src>`. Output normalised to fad-checker match shape, with the vendored file path attached so the report can show where the offending `.js` lives. Cache: `~/.fad-checker/retire-cache/<md5(src)>.json`, 24h TTL.
 9. **EOL / Obsolete / Outdated** — `lib/outdated.js`:
    - **EOL**: matches dep coord against `data/eol-mapping.json`, fetches the cycle list from endoflife.date (cached 7d), flags cycles past their EOL date.
    - **Obsolete**: lookup in `data/known-obsolete.json` (curated: log4j 1.x, jackson-mapper-asl, joda-time, commons-httpclient 3.x, …).
    - **Outdated**: Maven Central Solr query for the latest version. Cache 24h. Concurrency 8.
 10. **Snyk** (optional, `--snyk`) — runs `snyk test --all-projects --json` against the cleaned target dir. Normalised + merged. Findings in both sources tagged `source: "both"`.
-11. **Render** — `writeReports()` produces `cve-report.html` (self-contained, inline CSS, no external assets) and `cve-report.doc` (same HTML with Office XML namespace meta tags so Word opens it natively). Default output dir: `./fad-check-report/`.
+11. **Render** — `writeReports()` produces `cve-report.html` (self-contained, inline CSS, no external assets) and `cve-report.doc` (same HTML with Office XML namespace meta tags so Word opens it natively). Default output dir: `./fad-checker-report/`.
 
 ## Report structure
 
@@ -130,7 +130,7 @@ The Maven keyspace and npm keyspace never collide — `:lodash` (Maven groupId-l
 - The CVE bundle from CVEProject is ~500 MB unpacked. We shell out to `curl + unzip` (Node built-in fallback to `fetch()` + system `unzip` / PowerShell `Expand-Archive`). The extracted JSON is deleted after the index is built.
 - The bundle ships as `cves.zip.zip` (a zip whose sole content is another zip). `extractZip()` recurses up to 3 levels.
 - `endoflife.date` API responses are cached locally for 7 days; Maven Central version lookups for 24 hours.
-- **Persistent config**: `~/.fad-check/config.json` (mode 0600) stores per-user state, currently the NVD API key. Set via `fad-check --set-nvd-key <KEY>`.
+- **Persistent config**: `~/.fad-checker/config.json` (mode 0600) stores per-user state, currently the NVD API key. Set via `fad-checker --set-nvd-key <KEY>`.
 - **`--offline` umbrella flag**: skips every network call (CVE index download, OSV queries, NVD enrichment, endoflife.date lookups, Maven Central version queries, transitive POM fetches, retire.js scans). Falls back to whatever is already cached. Per-source variants (`--cve-offline`, `--no-osv`, `--no-nvd`, `--no-retire`) still work independently.
 - `snyk` is not a dependency — we shell out via `execFile`. `snyk` exits 1 when it finds vulnerabilities, which is expected (the JSON is still on stdout).
 - The cleaned POM is the union of every profile's deps. Counts will therefore be larger than the source POM. This is intentional — verify your reasoning before "reducing" them.

package/docs/USAGE.md

@@ -5,7 +5,7 @@ Every flag, every common workflow, with copy-pasteable commands.
 ## Synopsis
 
 ```text
-fad-check -s <src> [-t <target>] [-e <regex>] [other options]
+fad-checker -s <src> [-t <target>] [-e <regex>] [other options]
 ```
 
 - `-s, --src <src>` — **required**. Root of the source tree to scan. Contains `pom.xml` and/or `package(-lock).json` / `yarn.lock`.
@@ -13,21 +13,21 @@ fad-check -s <src> [-t <target>] [-e <regex>] [other options]
 
 ## Output
 
-By default the HTML + Word reports land in `./fad-check-report/`. Override with `--report-output <dir>`.
+By default the HTML + Word reports land in `./fad-checker-report/`. Override with `--report-output <dir>`.
 
 ## Ecosystem selection
 
 ```bash
 # Auto-detect (default): scan whatever pom.xml / package(-lock).json / yarn.lock exists
-fad-check -s .
+fad-checker -s .
 
 # Force one ecosystem
-fad-check -s . --ecosystem maven
-fad-check -s . --ecosystem npm
-fad-check -s . --ecosystem both     # scan both even if only one is auto-detected
+fad-checker -s . --ecosystem maven
+fad-checker -s . --ecosystem npm
+fad-checker -s . --ecosystem both     # scan both even if only one is auto-detected
 
 # Disable JS scanning entirely (Maven-only)
-fad-check -s . --no-js
+fad-checker -s . --no-js
 ```
 
 ## Filtering deps
@@ -35,8 +35,8 @@ fad-check -s . --no-js
 `-e <regex>` filters out coords whose **groupId** (Maven) or **name** (npm) matches the regex. Useful for private/internal libs that you know aren't on a public registry.
 
 ```bash
-fad-check -s . -e "^(com\.acme|org\.private)\."
-fad-check -s . -e "^@acme/"
+fad-checker -s . -e "^(com\.acme|org\.private)\."
+fad-checker -s . -e "^@acme/"
 ```
 
 The excluded coords are listed at the end of the run so you can audit the regex.
@@ -59,18 +59,18 @@ Each data source can be disabled independently:
 
 ```bash
 # Use cached data only, no network (works for everything)
-fad-check -s . --offline
+fad-checker -s . --offline
 
 # Per-source offline
-fad-check -s . --cve-offline                  # use cached CVE index only
-fad-check -s . --cve-refresh                  # force re-download of CVE bundle
-fad-check -s . --retire-refresh               # force re-scan with retire.js (ignore cache)
+fad-checker -s . --cve-offline                  # use cached CVE index only
+fad-checker -s . --cve-refresh                  # force re-download of CVE bundle
+fad-checker -s . --retire-refresh               # force re-scan with retire.js (ignore cache)
 
 # Cache export / import (useful for air-gapped boxes)
-fad-check --export-cache fad-cache.tar.gz
-fad-check --export-cache fad-cache.tar.gz --include-config   # bundle NVD key too
-fad-check --import-cache fad-cache.tar.gz
-fad-check --import-cache fad-cache.tar.gz --force            # replace existing without backup
+fad-checker --export-cache fad-cache.tar.gz
+fad-checker --export-cache fad-cache.tar.gz --include-config   # bundle NVD key too
+fad-checker --import-cache fad-cache.tar.gz
+fad-checker --import-cache fad-cache.tar.gz --force            # replace existing without backup
 ```
 
 ## NVD API key
@@ -79,24 +79,24 @@ NVD's public rate limit is 5 requests / 30s without a key. The free key bumps it
 
 ```bash
 # Get a key in 30 seconds: https://nvd.nist.gov/developers/request-an-api-key
-fad-check --set-nvd-key YOUR_KEY      # stored in ~/.fad-check/config.json (mode 0600)
-fad-check --show-config               # confirm it's persisted (key masked)
+fad-checker --set-nvd-key YOUR_KEY      # stored in ~/.fad-checker/config.json (mode 0600)
+fad-checker --show-config               # confirm it's persisted (key masked)
 ```
 
 Or pass it ad-hoc via the `NVD_API_KEY` env var.
 
 ## Snyk integration
 
-If you have `snyk` installed and authenticated, `fad-check` can drive it:
+If you have `snyk` installed and authenticated, `fad-checker` can drive it:
 
 ```bash
-fad-check -s ./proj -t ../proj-clean -e "^com\.acme\." --snyk
+fad-checker -s ./proj -t ../proj-clean -e "^com\.acme\." --snyk
 ```
 
 This:
 1. Generates the cleaned POM tree at `../proj-clean/`.
 2. Runs `snyk test --all-projects --json` against it.
-3. Merges Snyk's findings into the report — entries present in both `fad-check` and Snyk are tagged `source: "both"`.
+3. Merges Snyk's findings into the report — entries present in both `fad-checker` and Snyk are tagged `source: "both"`.
 
 `--snyk` requires `-t` (Snyk needs a real POM tree to scan).
 
@@ -104,7 +104,7 @@ This:
 
 | Mode | Trigger | Disk writes |
 | --- | --- | --- |
-| Read-only | `-t` omitted (default) | Only `~/.fad-check/` caches and the report dir |
+| Read-only | `-t` omitted (default) | Only `~/.fad-checker/` caches and the report dir |
 | Write | `-t <dir>` provided | Above + the cleaned POM tree at `<dir>` (and `<dir>` is `rimraf`'d first!) |
 
 The `--target` guardrails refuse:
@@ -114,30 +114,30 @@ The `--target` guardrails refuse:
 ## Verbosity
 
 ```bash
-fad-check -s . -v          # progress per source (OSV batches, NVD pages, retire scan, …)
+fad-checker -s . -v          # progress per source (OSV batches, NVD pages, retire scan, …)
 ```
 
 ## Shell completion
 
 ```bash
-fad-check --completion bash > /etc/bash_completion.d/fad-check
-fad-check --completion zsh  > ~/.zsh/completions/_fad-check
+fad-checker --completion bash > /etc/bash_completion.d/fad-checker
+fad-checker --completion zsh  > ~/.zsh/completions/_fad-checker
 ```
 
 ## All flags at a glance
 
 ```bash
-fad-check --help
+fad-checker --help
 ```
 
 ## Recipes
 
 ### CI gate: fail the build on any CRITICAL prod CVE
 
-`fad-check` exits 0 even when CVEs are found (it's a reporter, not a gate). Wire your own:
+`fad-checker` exits 0 even when CVEs are found (it's a reporter, not a gate). Wire your own:
 
 ```bash
-fad-check -s . --no-nvd > /dev/null
+fad-checker -s . --no-nvd > /dev/null
 # Then grep the report or parse the structured output (planned).
 ```
 
@@ -148,7 +148,7 @@ fad-check -s . --no-nvd > /dev/null
 Keep dated copies of the report:
 
 ```bash
-fad-check -s . --report-output reports/$(date +%F)
+fad-checker -s . --report-output reports/$(date +%F)
 diff reports/2026-04-01/cve-report.html reports/2026-05-01/cve-report.html
 ```
 
@@ -157,15 +157,15 @@ diff reports/2026-04-01/cve-report.html reports/2026-05-01/cve-report.html
 On a connected machine:
 
 ```bash
-fad-check -s ./dummy-empty-dir       # populates ~/.fad-check/ caches
-fad-check --export-cache fad-cache.tar.gz --include-config
+fad-checker -s ./dummy-empty-dir       # populates ~/.fad-checker/ caches
+fad-checker --export-cache fad-cache.tar.gz --include-config
 ```
 
 Move `fad-cache.tar.gz` to the air-gapped box, then:
 
 ```bash
-fad-check --import-cache fad-cache.tar.gz
-fad-check -s ./real-project --offline
+fad-checker --import-cache fad-cache.tar.gz
+fad-checker -s ./real-project --offline
 ```
 
 ### Monorepo with Maven + JS + vendored JS
@@ -173,7 +173,7 @@ fad-check -s ./real-project --offline
 The melino-style project (Java backend, React frontend in `web/`, vendored jQuery/PDF.js under `web/src/main/webapp/`):
 
 ```bash
-fad-check -s . -e "^(com\.captcha|org\.voxaly|com\.voxaly)\."
+fad-checker -s . -e "^(com\.captcha|org\.voxaly|com\.voxaly)\."
 # → finds CVE in Maven deps, in web/package-lock.json deps,
 #   AND in the vendored .js files under webapp/.
 ```

package/{fad-check.js → fad-checker.js}

@@ -27,7 +27,7 @@ if (process.argv.includes("--completion")) {
 	const shell = process.argv[shellIdx] && !process.argv[shellIdx].startsWith("-")
 		? process.argv[shellIdx]
 		: "bash";
-	const completionPath = path.join(__dirname, "completions", `fad-check.${shell}`);
+	const completionPath = path.join(__dirname, "completions", `fad-checker.${shell}`);
 	try {
 		process.stdout.write(fs.readFileSync(completionPath, "utf8"));
 		process.exit(0);
@@ -87,7 +87,7 @@ if (process.argv.includes("--add-repo") || process.argv.includes("--remove-repo"
 		const url = process.argv[idx + 2];
 		if (!name || name.startsWith("-") || !url || url.startsWith("-")) {
 			console.error(chalk.red("❌  --add-repo requires <name> <url>"));
-			console.error("   Example: fad-check --add-repo nexus https://nexus.acme.com/repository/maven-public/");
+			console.error("   Example: fad-checker --add-repo nexus https://nexus.acme.com/repository/maven-public/");
 			console.error("   Optional auth: --add-repo nexus https://nexus.acme.com/repository/maven-public/ --auth user:pass");
 			process.exit(1);
 		}
@@ -121,7 +121,7 @@ if (process.argv.includes("--export-cache") || process.argv.includes("--import-c
 			if (exportIdx !== -1) {
 				const dest = process.argv[exportIdx + 1];
 				if (!dest || dest.startsWith("-")) {
-					console.error(chalk.red("❌  --export-cache requires a destination path (e.g. fad-check-cache.tar.gz)"));
+					console.error(chalk.red("❌  --export-cache requires a destination path (e.g. fad-checker-cache.tar.gz)"));
 					process.exit(1);
 				}
 				const includeConfig = process.argv.includes("--include-config");
@@ -150,11 +150,11 @@ if (process.argv.includes("--export-cache") || process.argv.includes("--import-c
 }
 
 const USAGE = `
-(1) fad-check -s ./proj                                              # read-only: full report (CVE + EOL + obsolete + outdated + transitive)
-(2) fad-check -s ./proj -e "^(org.private|client)"                   # same, with regex exclusion of private deps
-(3) fad-check -s ./proj -t ../pom-clean -e "^(org.private|client)"   # write cleaned POMs + full report
-(4) fad-check -s ./proj --no-transitive --no-all-libs                # faster, only direct deps, no Maven Central queries
-(5) fad-check -s ./proj -t ../pom-clean -e "^..." --snyk             # also run snyk and merge findings
+(1) fad-checker -s ./proj                                              # read-only: full report (CVE + EOL + obsolete + outdated + transitive)
+(2) fad-checker -s ./proj -e "^(org.private|client)"                   # same, with regex exclusion of private deps
+(3) fad-checker -s ./proj -t ../pom-clean -e "^(org.private|client)"   # write cleaned POMs + full report
+(4) fad-checker -s ./proj --no-transitive --no-all-libs                # faster, only direct deps, no Maven Central queries
+(5) fad-checker -s ./proj -t ../pom-clean -e "^..." --snyk             # also run snyk and merge findings
 `;
 
 program
@@ -173,13 +173,13 @@ program
 	.option("--no-osv", "skip OSV.dev (Google/GitHub aggregated Maven CVE feed)")
 	.option("--no-nvd", "skip NIST NVD enrichment of matched CVEs")
 	.option("--offline", "no network: use cached CVE/OSV/NVD/POM data only")
-	.option("--set-nvd-key <key>", "save NVD API key to ~/.fad-check/config.json (10× faster NVD enrichment)")
-	.option("--show-config", "print the persisted ~/.fad-check/config.json")
-	.option("--export-cache <file>", "tar.gz/zip the ~/.fad-check/ caches to <file> (excludes config.json by default)")
-	.option("--import-cache <file>", "restore ~/.fad-check/ from a previously exported archive (existing dir is moved to .bak unless --force)")
+	.option("--set-nvd-key <key>", "save NVD API key to ~/.fad-checker/config.json (10× faster NVD enrichment)")
+	.option("--show-config", "print the persisted ~/.fad-checker/config.json")
+	.option("--export-cache <file>", "tar.gz/zip the ~/.fad-checker/ caches to <file> (excludes config.json by default)")
+	.option("--import-cache <file>", "restore ~/.fad-checker/ from a previously exported archive (existing dir is moved to .bak unless --force)")
 	.option("--include-config", "with --export-cache: also bundle config.json (contains the NVD API key)")
-	.option("--force", "with --import-cache: replace ~/.fad-check/ without backup")
-	.option("--report-output <dir>", "report output directory", "./fad-check-report")
+	.option("--force", "with --import-cache: replace ~/.fad-checker/ without backup")
+	.option("--report-output <dir>", "report output directory", "./fad-checker-report")
 	.option("--ignore-test", "skip test-scoped dependencies in report")
 	.option("--cve-refresh", "force re-download of CVE database")
 	.option("--cve-offline", "use cached CVE index only (no download)")
@@ -218,7 +218,7 @@ async function checkMavenLibExist(groupId, artifactId, repos) {
 	const p = `${g.replace(/\./g, "/")}/${a}/maven-metadata.xml`;
 	const { existsInAny } = require("./lib/maven-repo");
 	try {
-		const hit = await existsInAny(repos, p, { userAgent: "fad-check-existence" });
+		const hit = await existsInAny(repos, p, { userAgent: "fad-checker-existence" });
 		if (hit) return true;
 		console.log(`❌  NOT found on any repo: ${g}:${a}`);
 		return false;
@@ -231,7 +231,7 @@ async function checkMavenLibExist(groupId, artifactId, repos) {
 (async function main() {
 	console.log(chalk.bold.cyan("\n🚀 Fucking Autonomous Dependency Checker\n") + chalk.gray("─────────────────────────────"));
 
-	// Build the Maven repo list once: persisted repos (from ~/.fad-check/config.json)
+	// Build the Maven repo list once: persisted repos (from ~/.fad-checker/config.json)
 	// + ad-hoc --repo URLs + Maven Central as final fallback. Used by transitive
 	// resolution, outdated-version check, and existence check.
 	const { getMavenRepos } = require("./lib/config");
@@ -401,7 +401,7 @@ async function runReportFlow(allPomMetadata, allPropsByPom, ecoFlags = {}) {
 	}
 	const directCount = resolved.size;
 
-	// Scan-completeness signals: BOMs and unresolved-version deps mean fad-check
+	// Scan-completeness signals: BOMs and unresolved-version deps mean fad-checker
 	// has gone as far as it can without running Maven/Snyk itself.
 	if (runMaven) {
 		const { detectScanCompletenessWarnings } = require("./lib/scan-completeness");
@@ -581,7 +581,7 @@ async function runReportFlow(allPomMetadata, allPropsByPom, ecoFlags = {}) {
 	if (!outdatedResults.length && options.allLibs) console.log(chalk.gray("     (none)"));
 	if (!options.allLibs) console.log(chalk.gray("     (re-run with -a/--allLibs to query Maven Central)"));
 
-	const reportDir = options.reportOutput || "./fad-check-report";
+	const reportDir = options.reportOutput || "./fad-checker-report";
 	await fs.promises.mkdir(reportDir, { recursive: true });
 	const projectInfo = {
 		name: path.basename(path.resolve(options.src)),
@@ -613,7 +613,7 @@ async function runReportFlow(allPomMetadata, allPropsByPom, ecoFlags = {}) {
 					const paths = (dep?.pomPaths || []).map(p => path.relative(options.src, p));
 					return { id, manifestPaths: paths };
 				}),
-				message: `${privateLibIds.length} Maven coord(s) not found on Maven Central — they are private/internal libraries. Their CVEs (if any) cannot be detected by fad-check; if you have an internal CVE feed, audit them separately.`,
+				message: `${privateLibIds.length} Maven coord(s) not found on Maven Central — they are private/internal libraries. Their CVEs (if any) cannot be detected by fad-checker; if you have an internal CVE feed, audit them separately.`,
 			}] : []),
 		],
 	});

package/lib/cache-archive.js

@@ -1,5 +1,5 @@
 /**
- * lib/cache-archive.js — export / import the entire ~/.fad-check/ directory.
+ * lib/cache-archive.js — export / import the entire ~/.fad-checker/ directory.
  *
  * Use case:
  *   - Move the warmed-up CVE/OSV/NVD/POM caches between machines
@@ -20,17 +20,17 @@ const { execFile } = require("child_process");
 const { promisify } = require("util");
 const execFileP = promisify(execFile);
 
-const FAD_CACHE_DIR = path.join(os.homedir(), ".fad-check");
+const FAD_CACHE_DIR = path.join(os.homedir(), ".fad-checker");
 
 /**
- * Files inside ~/.fad-check/ that hold secrets and should NOT be shipped by default.
+ * Files inside ~/.fad-checker/ that hold secrets and should NOT be shipped by default.
  * Override by passing `includeConfig: true`.
  */
 const SENSITIVE_FILES = ["config.json"];
 
 async function exportCache(destFile, opts = {}) {
 	const { verbose, includeConfig } = opts;
-	if (!fs.existsSync(FAD_CACHE_DIR)) throw new Error(`no ~/.fad-check/ directory to export`);
+	if (!fs.existsSync(FAD_CACHE_DIR)) throw new Error(`no ~/.fad-checker/ directory to export`);
 	const abs = path.resolve(destFile);
 	fs.mkdirSync(path.dirname(abs), { recursive: true });
 
@@ -49,7 +49,7 @@ async function exportCache(destFile, opts = {}) {
 			if (verbose) console.log(`📦 Compress-Archive -Path ${FAD_CACHE_DIR}\\* -DestinationPath ${abs}`);
 			// Powershell Compress-Archive doesn't have a clean exclude flag — manual copy
 			await execFileP("powershell", ["-NoProfile", "-Command",
-				`$src='${FAD_CACHE_DIR}'; $dst='${abs}'; ${includeConfig ? `Compress-Archive -Path "$src\\*" -DestinationPath $dst -Force` : `$tmp=Join-Path $env:TEMP "fad-check-stage-$(Get-Random)"; Copy-Item $src $tmp -Recurse; ${SENSITIVE_FILES.map(f => `Remove-Item -Force -ErrorAction SilentlyContinue (Join-Path $tmp '${f}')`).join("; ")}; Compress-Archive -Path "$tmp\\*" -DestinationPath $dst -Force; Remove-Item $tmp -Recurse -Force`}`]);
+				`$src='${FAD_CACHE_DIR}'; $dst='${abs}'; ${includeConfig ? `Compress-Archive -Path "$src\\*" -DestinationPath $dst -Force` : `$tmp=Join-Path $env:TEMP "fad-checker-stage-$(Get-Random)"; Copy-Item $src $tmp -Recurse; ${SENSITIVE_FILES.map(f => `Remove-Item -Force -ErrorAction SilentlyContinue (Join-Path $tmp '${f}')`).join("; ")}; Compress-Archive -Path "$tmp\\*" -DestinationPath $dst -Force; Remove-Item $tmp -Recurse -Force`}`]);
 		} else {
 			const args = ["-r", "-q", abs, path.basename(FAD_CACHE_DIR)];
 			for (const e of excludes) { args.push("-x"); args.push(e); }
@@ -70,13 +70,13 @@ async function importCache(srcFile, opts = {}) {
 	if (!fs.existsSync(abs)) throw new Error(`archive not found: ${abs}`);
 
 	if (fs.existsSync(FAD_CACHE_DIR) && !force) {
-		// Move existing aside as .fad-check.bak-<timestamp>
+		// Move existing aside as .fad-checker.bak-<timestamp>
 		const backup = `${FAD_CACHE_DIR}.bak-${Date.now()}`;
 		fs.renameSync(FAD_CACHE_DIR, backup);
-		if (verbose) console.log(`💾 existing ~/.fad-check/ moved to ${backup}`);
+		if (verbose) console.log(`💾 existing ~/.fad-checker/ moved to ${backup}`);
 	} else if (force && fs.existsSync(FAD_CACHE_DIR)) {
 		fs.rmSync(FAD_CACHE_DIR, { recursive: true, force: true });
-		if (verbose) console.log(`🗑  --force: existing ~/.fad-check/ removed`);
+		if (verbose) console.log(`🗑  --force: existing ~/.fad-checker/ removed`);
 	}
 
 	const parent = path.dirname(FAD_CACHE_DIR);
@@ -99,7 +99,7 @@ async function importCache(srcFile, opts = {}) {
 	}
 
 	if (!fs.existsSync(FAD_CACHE_DIR)) {
-		throw new Error(`import completed but ~/.fad-check/ was not created — was the archive built with fad-check --export-cache?`);
+		throw new Error(`import completed but ~/.fad-checker/ was not created — was the archive built with fad-checker --export-cache?`);
 	}
 	return { dir: FAD_CACHE_DIR };
 }

package/lib/config.js

@@ -1,5 +1,5 @@
 /**
- * lib/config.js — persistent user config in ~/.fad-check/config.json
+ * lib/config.js — persistent user config in ~/.fad-checker/config.json
  *
  * Stores credentials and per-user preferences that should survive across runs.
  * Currently: NVD API key (so users don't have to re-export the env var).
@@ -8,7 +8,7 @@ const fs = require("fs");
 const path = require("path");
 const os = require("os");
 
-const CONFIG_DIR = path.join(os.homedir(), ".fad-check");
+const CONFIG_DIR = path.join(os.homedir(), ".fad-checker");
 const CONFIG_PATH = path.join(CONFIG_DIR, "config.json");
 
 function load() {
@@ -35,7 +35,7 @@ function get(key) {
 	return load()[key];
 }
 
-/** NVD API key resolution: env var first, then ~/.fad-check/config.json. */
+/** NVD API key resolution: env var first, then ~/.fad-checker/config.json. */
 function getNvdApiKey() {
 	return process.env.NVD_API_KEY || get("nvd_api_key") || null;
 }

package/lib/cve-download.js

@@ -13,7 +13,7 @@ const { execFile } = require("child_process");
 const { promisify } = require("util");
 const execFileP = promisify(execFile);
 
-const CVE_DATA_DIR = path.join(os.homedir(), ".fad-check", "cve-data");
+const CVE_DATA_DIR = path.join(os.homedir(), ".fad-checker", "cve-data");
 const CVE_INDEX_PATH = path.join(CVE_DATA_DIR, "maven-cve-index.json");
 const CVE_META_PATH = path.join(CVE_DATA_DIR, "meta.json");
 const CVE_EXTRACT_DIR = path.join(CVE_DATA_DIR, "extracted");
@@ -174,7 +174,7 @@ async function commandExists(name) {
 }
 
 async function fetchLatestRelease() {
-	const headers = { "User-Agent": "fad-check-cve-downloader" };
+	const headers = { "User-Agent": "fad-checker-cve-downloader" };
 	if (process.env.GITHUB_TOKEN) headers.Authorization = `Bearer ${process.env.GITHUB_TOKEN}`;
 	const res = await fetch("https://api.github.com/repos/CVEProject/cvelistV5/releases/latest", { headers });
 	if (!res.ok) throw new Error(`GitHub API HTTP ${res.status}`);
@@ -341,7 +341,7 @@ async function downloadCveData(opts = {}) {
 }
 
 /**
- * Single entry point used by fad-check.js: returns a usable CVE index,
+ * Single entry point used by fad-checker.js: returns a usable CVE index,
  * downloading/refreshing as needed.
  */
 async function ensureCveIndex(opts = {}) {

package/lib/cve-report.js

@@ -1246,11 +1246,11 @@ function buildBody({ cveMatches, devCveMatches, retireMatches, eolResults, obsol
 
 	return `
 		<header class="report-header">
-			<h1>FAD-Check Report</h1>
+			<h1>FAD-Checker Report</h1>
 			<div class="report-subtitle">Multi-ecosystem dependency security audit</div>
 			<div class="meta">
 				Project: <strong>${esc(projectInfo.name)}</strong> · <code class="path">${esc(projectInfo.src)}</code><br>
-				Generated: ${esc(projectInfo.generatedAt)}${projectInfo.toolVersion ? ` · fad-check ${esc(projectInfo.toolVersion)}` : ""}${projectInfo.cveDataDate ? ` · CVE data: ${esc(projectInfo.cveDataDate)}` : ""}
+				Generated: ${esc(projectInfo.generatedAt)}${projectInfo.toolVersion ? ` · fad-checker ${esc(projectInfo.toolVersion)}` : ""}${projectInfo.cveDataDate ? ` · CVE data: ${esc(projectInfo.cveDataDate)}` : ""}
 			</div>
 		</header>
 		${exec}
@@ -1401,7 +1401,7 @@ const TOGGLE_SCRIPT = `
 
 function generateHtmlReport(payload) {
 	return `<!doctype html>
-<html><head><meta charset="utf-8"><title>FAD-Check Report</title><style>${CSS}</style></head>
+<html><head><meta charset="utf-8"><title>FAD-Checker Report</title><style>${CSS}</style></head>
 <body>${buildBody(payload)}${TOGGLE_SCRIPT}</body></html>`;
 }
 
@@ -1426,7 +1426,7 @@ function generateWordReport(payload) {
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
 <meta name="ProgId" content="Word.Document">
 <meta name="Generator" content="Microsoft Word 15">
-<title>FAD-Check Report</title>
+<title>FAD-Checker Report</title>
 <style>${CSS}
 /* In Word: keep every detail row expanded since scripts are disabled */
 tr.detail-row { display: table-row !important; }

package/lib/maven-repo.js

@@ -8,7 +8,7 @@
  *   - Reading <maven-metadata.xml> for latest-version discovery
  *     (lib/outdated.js)
  *
- * Repository entry shape (from ~/.fad-check/config.json or CLI):
+ * Repository entry shape (from ~/.fad-checker/config.json or CLI):
  *   { name?, url, auth? }   auth = "user:pass" (we wrap as Basic <base64>)
  *
  * URL convention: each repo URL must end at the directory under which Maven
@@ -76,11 +76,11 @@ function authHeader(auth) {
  *   fetcher    custom fetch (for tests)
  *   readBody   read response.text() into body (default false to save mem
  *              on HEAD calls; transitive.js sets true for POMs)
- *   userAgent  default "fad-check-maven-repo"
+ *   userAgent  default "fad-checker-maven-repo"
  *   onMiss     callback(repo, status) for telemetry (verbose mode)
  */
 async function tryRepos(repos, pathSuffix, opts = {}) {
-	const { method = "GET", fetcher = globalThis.fetch, readBody = false, userAgent = "fad-check-maven-repo", onMiss } = opts;
+	const { method = "GET", fetcher = globalThis.fetch, readBody = false, userAgent = "fad-checker-maven-repo", onMiss } = opts;
 	for (const repo of repos) {
 		const url = repo.url + pathSuffix.replace(/^\//, "");
 		const headers = { "User-Agent": userAgent };

package/lib/nvd.js

@@ -9,14 +9,14 @@
  * API: https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-YYYY-NNNN
  * Rate limit: 5 req / 30s unauthenticated, 50 req / 30s with NVD_API_KEY env var.
  *
- * Cache: ~/.fad-check/nvd-cache/<cve-id>.json, 7-day TTL.
+ * Cache: ~/.fad-checker/nvd-cache/<cve-id>.json, 7-day TTL.
  */
 const fs = require("fs");
 const path = require("path");
 const os = require("os");
 const { getNvdApiKey } = require("./config");
 
-const NVD_CACHE_DIR = path.join(os.homedir(), ".fad-check", "nvd-cache");
+const NVD_CACHE_DIR = path.join(os.homedir(), ".fad-checker", "nvd-cache");
 const NVD_CACHE_TTL_MS = 7 * 24 * 3600 * 1000;
 const NVD_BASE = "https://services.nvd.nist.gov/rest/json/cves/2.0";
 
@@ -146,7 +146,7 @@ async function fetchOne(cveId, opts = {}) {
 	const cached = readCache(cveId);
 	if (cached !== null && cached !== undefined) return cached;
 	if (offline) return null;
-	const headers = { "User-Agent": "fad-check-nvd-enrich" };
+	const headers = { "User-Agent": "fad-checker-nvd-enrich" };
 	const key = getNvdApiKey();
 	if (key) headers["apiKey"] = key;
 	const url = `${NVD_BASE}?cveId=${encodeURIComponent(cveId)}`;
@@ -169,7 +169,7 @@ async function fetchOne(cveId, opts = {}) {
 }
 
 /**
- * Enrich an array of fad-check matches in place by fetching their NVD records.
+ * Enrich an array of fad-checker matches in place by fetching their NVD records.
  * Adds: cve.description (replaced by NVD's), cve.cvssVector, cve.cvssVersion,
  * cve.references, cve.cpes. Severity/score are only overwritten if currently UNKNOWN/null.
  *
@@ -205,7 +205,7 @@ async function enrichMatches(matches, opts = {}) {
 	for (const m of matches) {
 		const data = byId.get(m.cve?.id);
 		if (!data) continue;
-		// Merge: prefer NVD's official text + CVSS but keep what fad-check/OSV already has
+		// Merge: prefer NVD's official text + CVSS but keep what fad-checker/OSV already has
 		// NVD's description is the official long form — prefer it when available.
 		if (data.description) {
 			m.cve.description = data.description.length > 2000

package/lib/osv.js

@@ -11,13 +11,13 @@
  *   POST /v1/query       for a single dep
  *   GET  /v1/vulns/{id}  to fetch full details
  *
- * Cached responses live in ~/.fad-check/osv-cache/ for 12h.
+ * Cached responses live in ~/.fad-checker/osv-cache/ for 12h.
  */
 const fs = require("fs");
 const path = require("path");
 const os = require("os");
 
-const OSV_CACHE_DIR = path.join(os.homedir(), ".fad-check", "osv-cache");
+const OSV_CACHE_DIR = path.join(os.homedir(), ".fad-checker", "osv-cache");
 const OSV_CACHE_TTL_MS = 12 * 3600 * 1000;
 const OSV_BASE = "https://api.osv.dev";
 const BATCH_SIZE = 800;          // OSV limit is 1000; stay under for safety
@@ -101,7 +101,7 @@ function osvPkgName(dep) {
 	return dep.ecosystem === "npm" ? dep.artifactId : `${dep.groupId}:${dep.artifactId}`;
 }
 
-/** Convert one OSV vuln to fad-check match shape. */
+/** Convert one OSV vuln to fad-checker match shape. */
 function vulnToMatch(dep, vuln) {
 	const id = pickPrimaryId(vuln);
 	const { severity, score } = severityFromOsv(vuln);
@@ -180,7 +180,7 @@ async function queryBatch(deps, opts = {}) {
 			if (verbose) process.stdout.write(`\r   OSV batch ${++batchIdx}/${batches.length} (${batch.length} deps)…`);
 			const res = await fetcher(`${OSV_BASE}/v1/querybatch`, {
 				method: "POST",
-				headers: { "Content-Type": "application/json", "User-Agent": "fad-check-osv" },
+				headers: { "Content-Type": "application/json", "User-Agent": "fad-checker-osv" },
 				body: JSON.stringify({ queries: batch }),
 			});
 			if (!res.ok) {
@@ -223,7 +223,7 @@ async function queryBatch(deps, opts = {}) {
 		if (offline) continue;
 		try {
 			const r = await fetcher(`${OSV_BASE}/v1/vulns/${encodeURIComponent(id)}`, {
-				headers: { "User-Agent": "fad-check-osv" },
+				headers: { "User-Agent": "fad-checker-osv" },
 			});
 			if (r.ok) {
 				const body = await r.json();
@@ -265,7 +265,7 @@ function runMatches(deps, indexMap, detailById) {
 }
 
 /**
- * Public: query OSV for every dep in `resolvedDeps` Map, return fad-check-shape matches.
+ * Public: query OSV for every dep in `resolvedDeps` Map, return fad-checker-shape matches.
  */
 async function queryOsvForDeps(resolvedDeps, opts = {}) {
 	const deps = [];

package/lib/outdated.js

@@ -13,7 +13,7 @@ const { compareMavenVersions } = require("./maven-version");
 const KNOWN_OBSOLETE = require("../data/known-obsolete.json");
 const EOL_MAPPING = require("../data/eol-mapping.json");
 
-const CACHE_DIR = path.join(os.homedir(), ".fad-check");
+const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
 const EOL_CACHE_PATH = path.join(CACHE_DIR, "eol-cache.json");
 const VERSION_CACHE_PATH = path.join(CACHE_DIR, "version-cache.json");
 const EOL_CACHE_MAX_AGE_MS = 7 * 24 * 3600 * 1000; // 7 days
@@ -58,7 +58,7 @@ async function fetchEndoflife(product, cache, opts = {}) {
 	if (opts.offline) return null;
 	try {
 		const res = await fetch(`https://endoflife.date/api/${encodeURIComponent(product)}.json`, {
-			headers: { "User-Agent": "fad-check-eol-checker" },
+			headers: { "User-Agent": "fad-checker-eol-checker" },
 		});
 		if (!res.ok) {
 			cache.entries[product] = { error: `HTTP ${res.status}` };
@@ -174,7 +174,7 @@ async function fetchLatestVersion(groupId, artifactId, cache, opts = {}) {
 	// internal Nexus/Artifactory artifacts that aren't on Central.
 	try {
 		const url = `https://search.maven.org/solrsearch/select?q=g:%22${encodeURIComponent(groupId)}%22+AND+a:%22${encodeURIComponent(artifactId)}%22&core=gav&rows=1&wt=json`;
-		const res = await fetch(url, { headers: { "User-Agent": "fad-check-outdated-checker" } });
+		const res = await fetch(url, { headers: { "User-Agent": "fad-checker-outdated-checker" } });
 		if (res.ok) {
 			const json = await res.json();
 			const doc = json?.response?.docs?.[0];
@@ -189,7 +189,7 @@ async function fetchLatestVersion(groupId, artifactId, cache, opts = {}) {
 	if (Array.isArray(opts.repos) && opts.repos.length) {
 		try {
 			const { fetchMavenMetadata } = require("./maven-repo");
-			const hit = await fetchMavenMetadata(opts.repos, groupId, artifactId, { userAgent: "fad-check-outdated-checker" });
+			const hit = await fetchMavenMetadata(opts.repos, groupId, artifactId, { userAgent: "fad-checker-outdated-checker" });
 			if (hit?.body) {
 				const latest = parseMavenMetadataLatest(hit.body);
 				if (latest) {
@@ -231,7 +231,7 @@ async function checkOutdatedDeps(resolvedDeps, opts = {}) {
 	const list = [...resolvedDeps.values()].filter(d => d.version && !/\$\{|SNAPSHOT/i.test(d.version) && d.ecosystem !== "npm");
 	const results = [];
 
-	// Simple p-limit style throttle without requiring p-limit here (already used in fad-check.js)
+	// Simple p-limit style throttle without requiring p-limit here (already used in fad-checker.js)
 	let cursor = 0;
 	const workers = Array.from({ length: concurrency }, async () => {
 		while (cursor < list.length) {

package/lib/retire.js

@@ -4,10 +4,10 @@
  * unmanaged .js / .min.js files (no package-lock to back them).
  *
  * retire ships its own signature DB updated weekly; we just shell
- * out to it and normalise the output to fad-check match shape so the
+ * out to it and normalise the output to fad-checker match shape so the
  * report can render it like any other CVE source.
  *
- * Cache: ~/.fad-check/retire-cache/<md5(src)>.json, 24 h TTL.
+ * Cache: ~/.fad-checker/retire-cache/<md5(src)>.json, 24 h TTL.
  *
  * The CLI is expected at node_modules/.bin/retire (declared in
  * package.json deps). When bundled with bun, we also try `retire`
@@ -21,7 +21,7 @@ const { execFile } = require("child_process");
 const { promisify } = require("util");
 const execFileP = promisify(execFile);
 
-const RETIRE_CACHE_DIR = path.join(os.homedir(), ".fad-check", "retire-cache");
+const RETIRE_CACHE_DIR = path.join(os.homedir(), ".fad-checker", "retire-cache");
 const RETIRE_CACHE_TTL_MS = 24 * 3600 * 1000;
 
 function cacheKey(srcDir) {
@@ -82,7 +82,7 @@ async function runRetire(srcDir, opts = {}) {
 
 	// retire.js refuses to write to /dev/stdout, so we use a real temp file
 	// and read it back. Falls back to stdout if --outputpath is rejected.
-	const tmpOut = path.join(os.tmpdir(), `fad-check-retire-${process.pid}-${Date.now()}.json`);
+	const tmpOut = path.join(os.tmpdir(), `fad-checker-retire-${process.pid}-${Date.now()}.json`);
 	const args = [
 		"--outputformat", "json",
 		"--outputpath", tmpOut,
@@ -119,7 +119,7 @@ async function runRetire(srcDir, opts = {}) {
 }
 
 /**
- * Normalise a retire.js result tree to fad-check match shape.
+ * Normalise a retire.js result tree to fad-checker match shape.
  *
  * retire output (jsonsimple-ish):
  *   {

package/lib/scan-completeness.js

@@ -1,5 +1,5 @@
 /**
- * lib/scan-completeness.js — produce warnings telling the user when fad-check
+ * lib/scan-completeness.js — produce warnings telling the user when fad-checker
  * has gone as far as it can without running the real build tool.
  *
  * The two big "you need a real scan" cases:
@@ -57,7 +57,7 @@ function detectScanCompletenessWarnings(resolvedDeps, opts = {}) {
 			type: "unresolved-versions",
 			count: items.length,
 			items,
-			message: `${items.length} Maven dep(s) without a concrete version — silently skipped from CVE/OSV/outdated scans. Their versions are likely pinned by an external BOM or a property defined outside the source tree. Run "mvn dependency:tree" against the source (or "snyk test --all-projects" against the cleaned POMs${opts.ranSnyk ? " — already done with --snyk" : ", or re-run fad-check with --snyk"}) to resolve them and complete the scan.`,
+			message: `${items.length} Maven dep(s) without a concrete version — silently skipped from CVE/OSV/outdated scans. Their versions are likely pinned by an external BOM or a property defined outside the source tree. Run "mvn dependency:tree" against the source (or "snyk test --all-projects" against the cleaned POMs${opts.ranSnyk ? " — already done with --snyk" : ", or re-run fad-checker with --snyk"}) to resolve them and complete the scan.`,
 		});
 	}
 

package/lib/snyk.js

@@ -2,7 +2,7 @@
  * lib/snyk.js — optional Snyk integration.
  *
  * Runs `snyk test --all-projects --json` on the cleaned POM directory and
- * normalises the output to fad-check's CVE match shape so the report can
+ * normalises the output to fad-checker's CVE match shape so the report can
  * merge findings from both engines.
  */
 const { execFile } = require("child_process");
@@ -53,7 +53,7 @@ function parseSnykStdout(stdout) {
 }
 
 /**
- * Normalise snyk JSON to fad-check match objects:
+ * Normalise snyk JSON to fad-checker match objects:
  *   [{ dep: {groupId, artifactId, version}, cve: {id, severity, score, ...}, source: 'snyk' }]
  */
 function parseSnykResults(snykProjectsJson) {
@@ -91,8 +91,8 @@ function parseSnykResults(snykProjectsJson) {
 }
 
 /**
- * Merge fad-check and Snyk matches, deduping by (groupId:artifactId, cve.id).
- * When a finding exists in both, fad-check's row is kept but tagged source='both'.
+ * Merge fad-checker and Snyk matches, deduping by (groupId:artifactId, cve.id).
+ * When a finding exists in both, fad-checker's row is kept but tagged source='both'.
  */
 function mergeWithFadResults(fadMatches, snykMatches) {
 	const byKey = new Map();

package/lib/transitive.js

@@ -24,7 +24,7 @@ const path = require("path");
 const os = require("os");
 const { parseStringPromise } = require("xml2js");
 
-const POM_CACHE_DIR = path.join(os.homedir(), ".fad-check", "poms-cache");
+const POM_CACHE_DIR = path.join(os.homedir(), ".fad-checker", "poms-cache");
 const MAVEN_CENTRAL = "https://repo1.maven.org/maven2";
 
 // Maven's scope-propagation matrix (rows: direct dep scope, cols: transitive scope)
@@ -62,7 +62,7 @@ async function fetchPom(g, a, v, opts = {}) {
 	if (Array.isArray(repos)) {
 		try {
 			const { fetchPomFromRepos } = require("./maven-repo");
-			const hit = await fetchPomFromRepos(repos, g, a, v, { fetcher, userAgent: "fad-check-transitive" });
+			const hit = await fetchPomFromRepos(repos, g, a, v, { fetcher, userAgent: "fad-checker-transitive" });
 			if (hit?.body) {
 				await fs.promises.mkdir(cacheDir, { recursive: true });
 				await fs.promises.writeFile(cf, hit.body);
@@ -79,7 +79,7 @@ async function fetchPom(g, a, v, opts = {}) {
 	}
 	const url = pomPath(g, a, v);
 	try {
-		const res = await fetcher(url, { headers: { "User-Agent": "fad-check-transitive" } });
+		const res = await fetcher(url, { headers: { "User-Agent": "fad-checker-transitive" } });
 		if (res.status === 404) {
 			await fs.promises.mkdir(cacheDir, { recursive: true });
 			await fs.promises.writeFile(cf, "__NOT_FOUND__");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fad-checker",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Fucking Autonomous Dependency Checker — multi-ecosystem CVE / EOL / outdated / vendored-JS scanner for Maven, npm and Yarn monorepos. Self-contained HTML + Word report.",
   "license": "MIT",
   "author": "N8tz <n8tz.js@gmail.com>",
@@ -11,14 +11,14 @@
     "N8tz (https://github.com/N8tz)"
   ],
   "bin": {
-    "fad-checker": "fad-check.js",
-    "fad": "fad-check.js"
+    "fad-checker": "fad-checker.js",
+    "fad": "fad-checker.js"
   },
   "scripts": {
     "test": "node --test test/*.test.js",
-    "build:linux": "bun build fad-check.js --compile --target=bun-linux-x64 --outfile=dist/fad-check-linux",
-    "build:win": "bun build fad-check.js --compile --target=bun-windows-x64 --outfile=dist/fad-check.exe",
-    "build:macos": "bun build fad-check.js --compile --target=bun-darwin-x64 --outfile=dist/fad-check-macos",
+    "build:linux": "bun build fad-checker.js --compile --target=bun-linux-x64 --outfile=dist/fad-checker-linux",
+    "build:win": "bun build fad-checker.js --compile --target=bun-windows-x64 --outfile=dist/fad-checker.exe",
+    "build:macos": "bun build fad-checker.js --compile --target=bun-darwin-x64 --outfile=dist/fad-checker-macos",
     "build": "npm run build:linux && npm run build:win"
   },
   "dependencies": {

package/test/core.test.js

@@ -22,7 +22,7 @@ async function pipeline(src, { deps2Exclude } = {}) {
 }
 
 test("findPomFiles skips target/.git/node_modules", () => {
-	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "fad-check-test-"));
+	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "fad-checker-test-"));
 	fs.mkdirSync(path.join(tmp, "target"));
 	fs.writeFileSync(path.join(tmp, "target", "pom.xml"), "<project/>");
 	fs.writeFileSync(path.join(tmp, "pom.xml"), "<project/>");
@@ -93,7 +93,7 @@ test("BOM import (scope=import) pulls in managed deps from local BOM", async ()
 });
 
 test("rewritePoms writes a clean tree in --target mode, target ≠ src", async () => {
-	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "fad-check-target-"));
+	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "fad-checker-target-"));
 	const { store, props, pomFiles } = await pipeline(COMPLEX);
 	const opts = {
 		srcRoot: COMPLEX, targetRoot: tmp,
@@ -125,7 +125,7 @@ test("rewritePoms in --test (readOnly) mode does not crash with undefined target
 
 test("missing external parent is flagged in missingById", async () => {
 	const { store, props, pomFiles } = await pipeline(PRIVATE_FIX);
-	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "fad-check-priv-"));
+	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "fad-checker-priv-"));
 	const opts = {
 		srcRoot: PRIVATE_FIX, targetRoot: tmp,
 		deps2Exclude: /^(com\.client\.private|org\.megacorp)/,
@@ -143,7 +143,7 @@ test("missing external parent is flagged in missingById", async () => {
 
 test("parent version in rewritten POM uses parent's version, not child's", async () => {
 	// Simple has child app with no own <version>; the rewritten parent ref should be 1.0.0
-	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "fad-check-pv-"));
+	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "fad-checker-pv-"));
 	const { store, props, pomFiles } = await pipeline(SIMPLE);
 	const opts = { srcRoot: SIMPLE, targetRoot: tmp, deps2Exclude: null, verbose: false, readOnly: false };
 	for (const f of pomFiles) await core.rewritePoms(f, store, props, opts);

package/test/cve-report.test.js

@@ -61,7 +61,7 @@ test("generateWordReport contains Word XML namespaces", () => {
 });
 
 test("writeReports writes both files to disk", async () => {
-	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "fad-check-rep-"));
+	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "fad-checker-rep-"));
 	const r = await writeReports({
 		cveMatches: sampleMatches,
 		eolResults: [{ dep: { groupId: "org.hibernate", artifactId: "hibernate-core", version: "5.6" }, product: "Hibernate ORM", eol: "2025-08-08" }],

package/test/monorepo.test.js

@@ -4,7 +4,7 @@
  *   - 1 npm package (package-lock v3) with prod/dev/peer deps
  *   - 1 yarn-v1 package with prod/dev deps + a private @acme/* dep
  *
- * Drives the same code paths as `fad-check --report` minus the network calls.
+ * Drives the same code paths as `fad-checker --report` minus the network calls.
  */
 const { test } = require("node:test");
 const assert = require("node:assert/strict");

package/test/snyk.test.js

@@ -35,7 +35,7 @@ test("parseSnykStdout accepts a JSON object or array", () => {
 	assert.equal(obj.length, 1);
 });
 
-test("parseSnykResults normalises to fad-check match shape", () => {
+test("parseSnykResults normalises to fad-checker match shape", () => {
 	const out = parseSnykResults(snykSample);
 	assert.equal(out.length, 2);
 	assert.equal(out[0].dep.groupId, "org.apache.logging.log4j");

package/test/transitive.test.js

@@ -5,9 +5,9 @@ const os = require("os");
 const path = require("path");
 const { parsePomXml, resolveProps, buildMgmt, SCOPE_MATRIX, resolveTransitiveDeps } = require("../lib/transitive");
 
-// Per-test cache dir so we don't poison ~/.fad-check/poms-cache during tests
+// Per-test cache dir so we don't poison ~/.fad-checker/poms-cache during tests
 function freshCache() {
-	const dir = fs.mkdtempSync(path.join(os.tmpdir(), "fad-check-pom-cache-"));
+	const dir = fs.mkdtempSync(path.join(os.tmpdir(), "fad-checker-pom-cache-"));
 	return dir;
 }