fad-checker 1.0.3 → 1.0.5

package/CLAUDE.md

@@ -15,7 +15,7 @@ Code-level orientation for contributors and Claude Code sessions on this repo.
    - retire.js (vendored JS signatures),
    - optionally Snyk (`--snyk`).
 4. Cross-checks every match's NVD CPE configurations against the dep version (`lib/cpe.js`) to filter false positives.
-5. Reports EOL frameworks (endoflife.date), obsolete libs (curated), outdated libs (Maven Central).
+5. Reports EOL frameworks (endoflife.date — Maven & npm), obsolete libs (curated Maven + npm-registry per-version `deprecated` field — authoritative, skips nothing), outdated libs (Maven Central + npm registry `dist-tags.latest`). **WebJars** (`org.webjars*`) are reduced to their npm coordinate by `webjarToNpm()` and run through the npm EOL/deprecation/outdated paths — so e.g. `org.webjars:angularjs:1.8.3` is flagged EOL.
 6. Produces a self-contained HTML report + Word-compatible `.doc`, organised by ecosystem and by defining manifest, with per-tool fix recipes and an executive summary.
 
 No build tool (`mvn`, `npm install`, `yarn`) is required on PATH — `pom.xml` / `package-lock.json` / `yarn.lock` are parsed directly.
@@ -67,6 +67,7 @@ lib/retire.js                retire.js (vendored-JS scanner) wrapper + cache + n
 lib/scan-completeness.js     Warnings for deps fad-checker couldn't fully resolve.
 lib/npm/parse.js             package.json, package-lock.json (v1/2/3), yarn.lock v1 parsers.
 lib/npm/collect.js           Merge across JS manifests → unified resolvedDeps Map.
+lib/npm/registry.js          npm registry packument query → per-version deprecation + dist-tags.latest (npm EOL feeds via lib/outdated.js).
 lib/cache-archive.js         tar.gz / zip export & import of ~/.fad-checker/.
 lib/config.js                Persistent user config in ~/.fad-checker/config.json (mode 0600).
 data/                        known-obsolete.json, eol-mapping.json, cpe-coord-map.json, known-public-namespaces.json
@@ -106,7 +107,7 @@ Test fixtures live in `test/fixtures/`:
 - CVE bundle from CVEProject is ~500 MB unpacked. Shells out to `curl + unzip` (fallback to `fetch()` + `unzip` / `Expand-Archive`). Extracted JSON deleted after index build. Ships as `cves.zip.zip` (nested zip) — `extractZip()` recurses up to 3 levels.
 - `endoflife.date` API responses cached 7 days; Maven Central version lookups cached 24 hours. Cache lives in `~/.fad-checker/`.
 - **Persistent config**: `~/.fad-checker/config.json` (mode 0600). Set NVD key via `fad-checker --set-nvd-key <KEY>` (free, instant from <https://nvd.nist.gov/developers/request-an-api-key> — bumps rate limit from 5/30s to 50/30s).
-- **`--offline` umbrella flag**: skips every network call (CVE/OSV/NVD/Maven Central/endoflife/retire). Falls back to whatever is already cached. Per-source variants (`--cve-offline`, `--no-osv`, `--no-nvd`, `--no-retire`, `--no-transitive`) still work independently.
+- **`--offline` umbrella flag**: skips every network call (CVE/OSV/NVD/Maven Central/endoflife/npm-registry/retire). Falls back to whatever is already cached. Per-source variants (`--cve-offline`, `--no-osv`, `--no-nvd`, `--no-retire`, `--no-transitive`, `--no-js`) still work independently. npm registry deprecation always runs when online; npm (and Maven) outdated is gated by `--no-all-libs`.
 - `snyk` is not a hard dep — shells out via `execFile`. `snyk` exits 1 on findings; the JSON is still on stdout.
 - The cleaned POM is the union of every profile's deps. Counts will be larger than the source POM. Intentional — don't "fix" that.
 - Unresolved `${…}` Maven variables stay verbatim in the rewritten POM. `lib/cve-match.js` resolves them lazily via `resolveDepVersion()` when scanning. Deps that *still* can't be resolved (external BOM not in source tree) surface in chapter 0 as `unresolved-versions` warnings.
@@ -122,5 +123,6 @@ Test fixtures live in `test/fixtures/`:
 | NVD CVE record | `~/.fad-checker/nvd-cache/<cveId>.json` | 7 d |
 | endoflife.date cycles | `~/.fad-checker/eol-cache.json` | 7 d |
 | Maven Central latest | `~/.fad-checker/version-cache.json` | 24 h |
+| npm registry (deprecation + latest) | `~/.fad-checker/npm-registry-cache.json` | 24 h |
 | Transitive POM | `~/.fad-checker/poms-cache/<g>__<a>__<v>.pom` | ∞ (immutable on Maven Central) |
 | retire.js findings | `~/.fad-checker/retire-cache/<md5(src)>.json` | 24 h |

package/data/cwe-names.json

@@ -0,0 +1,192 @@
+{
+  "_comment": "Common CWE identifiers → short human name. Covers the bulk of CVEs in practice. Source: cwe.mitre.org. Names are abbreviated for compact UI display.",
+  "CWE-20": "Improper Input Validation",
+  "CWE-22": "Path Traversal",
+  "CWE-59": "Link Following",
+  "CWE-74": "Improper Neutralization of Special Elements (Injection)",
+  "CWE-77": "Command Injection",
+  "CWE-78": "OS Command Injection",
+  "CWE-79": "Cross-site Scripting (XSS)",
+  "CWE-88": "Argument Injection",
+  "CWE-89": "SQL Injection",
+  "CWE-90": "LDAP Injection",
+  "CWE-91": "XML Injection",
+  "CWE-93": "CRLF Injection",
+  "CWE-94": "Code Injection",
+  "CWE-95": "Eval Injection",
+  "CWE-113": "HTTP Response Splitting",
+  "CWE-115": "Misinterpretation of Input",
+  "CWE-116": "Improper Encoding or Escaping of Output",
+  "CWE-117": "Improper Output Neutralization for Logs",
+  "CWE-118": "Incorrect Access of Indexable Resource",
+  "CWE-119": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
+  "CWE-120": "Buffer Copy without Checking Size (Classic Buffer Overflow)",
+  "CWE-121": "Stack-based Buffer Overflow",
+  "CWE-122": "Heap-based Buffer Overflow",
+  "CWE-125": "Out-of-bounds Read",
+  "CWE-129": "Improper Validation of Array Index",
+  "CWE-131": "Incorrect Calculation of Buffer Size",
+  "CWE-134": "Use of Externally-Controlled Format String",
+  "CWE-178": "Improper Handling of Case Sensitivity",
+  "CWE-184": "Incomplete List of Disallowed Inputs",
+  "CWE-185": "Incorrect Regular Expression",
+  "CWE-190": "Integer Overflow or Wraparound",
+  "CWE-191": "Integer Underflow",
+  "CWE-193": "Off-by-one Error",
+  "CWE-200": "Exposure of Sensitive Information to an Unauthorized Actor",
+  "CWE-203": "Observable Discrepancy",
+  "CWE-204": "Observable Response Discrepancy",
+  "CWE-208": "Observable Timing Discrepancy",
+  "CWE-209": "Generation of Error Message Containing Sensitive Information",
+  "CWE-212": "Improper Removal of Sensitive Information Before Storage or Transfer",
+  "CWE-215": "Insertion of Sensitive Information Into Debugging Code",
+  "CWE-226": "Sensitive Information in Resource Not Removed Before Reuse",
+  "CWE-241": "Improper Handling of Unexpected Data Type",
+  "CWE-248": "Uncaught Exception",
+  "CWE-252": "Unchecked Return Value",
+  "CWE-256": "Plaintext Storage of a Password",
+  "CWE-257": "Storing Passwords in a Recoverable Format",
+  "CWE-259": "Use of Hard-coded Password",
+  "CWE-260": "Password in Configuration File",
+  "CWE-261": "Weak Encoding for Password",
+  "CWE-262": "Not Using Password Aging",
+  "CWE-269": "Improper Privilege Management",
+  "CWE-272": "Least Privilege Violation",
+  "CWE-273": "Improper Check for Dropped Privileges",
+  "CWE-275": "Permission Issues",
+  "CWE-276": "Incorrect Default Permissions",
+  "CWE-281": "Improper Preservation of Permissions",
+  "CWE-284": "Improper Access Control",
+  "CWE-285": "Improper Authorization",
+  "CWE-287": "Improper Authentication",
+  "CWE-288": "Authentication Bypass Using an Alternate Path or Channel",
+  "CWE-290": "Authentication Bypass by Spoofing",
+  "CWE-294": "Authentication Bypass by Capture-replay",
+  "CWE-295": "Improper Certificate Validation",
+  "CWE-296": "Improper Following of a Certificate's Chain of Trust",
+  "CWE-297": "Improper Validation of Certificate with Host Mismatch",
+  "CWE-298": "Improper Validation of Certificate Expiration",
+  "CWE-299": "Improper Check for Certificate Revocation",
+  "CWE-300": "Channel Accessible by Non-Endpoint (MITM)",
+  "CWE-303": "Incorrect Implementation of Authentication Algorithm",
+  "CWE-305": "Authentication Bypass by Primary Weakness",
+  "CWE-306": "Missing Authentication for Critical Function",
+  "CWE-307": "Improper Restriction of Excessive Authentication Attempts",
+  "CWE-311": "Missing Encryption of Sensitive Data",
+  "CWE-312": "Cleartext Storage of Sensitive Information",
+  "CWE-319": "Cleartext Transmission of Sensitive Information",
+  "CWE-320": "Key Management Errors",
+  "CWE-321": "Use of Hard-coded Cryptographic Key",
+  "CWE-326": "Inadequate Encryption Strength",
+  "CWE-327": "Use of a Broken or Risky Cryptographic Algorithm",
+  "CWE-328": "Use of Weak Hash",
+  "CWE-329": "Generation of Predictable IV with CBC Mode",
+  "CWE-330": "Use of Insufficiently Random Values",
+  "CWE-331": "Insufficient Entropy",
+  "CWE-335": "Incorrect Usage of Seeds in PRNG",
+  "CWE-338": "Use of Cryptographically Weak PRNG",
+  "CWE-345": "Insufficient Verification of Data Authenticity",
+  "CWE-346": "Origin Validation Error",
+  "CWE-347": "Improper Verification of Cryptographic Signature",
+  "CWE-352": "Cross-Site Request Forgery (CSRF)",
+  "CWE-354": "Improper Validation of Integrity Check Value",
+  "CWE-358": "Improperly Implemented Security Check for Standard",
+  "CWE-362": "Race Condition",
+  "CWE-367": "TOCTOU Race Condition",
+  "CWE-369": "Divide By Zero",
+  "CWE-377": "Insecure Temporary File",
+  "CWE-378": "Creation of Temporary File With Insecure Permissions",
+  "CWE-384": "Session Fixation",
+  "CWE-390": "Detection of Error Condition Without Action",
+  "CWE-400": "Uncontrolled Resource Consumption (DoS)",
+  "CWE-401": "Missing Release of Memory after Effective Lifetime",
+  "CWE-402": "Transmission of Private Resources into a New Sphere",
+  "CWE-404": "Improper Resource Shutdown or Release",
+  "CWE-405": "Asymmetric Resource Consumption (Amplification)",
+  "CWE-407": "Inefficient Algorithmic Complexity",
+  "CWE-409": "Improper Handling of Highly Compressed Data (Zip Bomb)",
+  "CWE-415": "Double Free",
+  "CWE-416": "Use After Free",
+  "CWE-419": "Unprotected Primary Channel",
+  "CWE-425": "Direct Request (Forced Browsing)",
+  "CWE-426": "Untrusted Search Path",
+  "CWE-427": "Uncontrolled Search Path Element",
+  "CWE-428": "Unquoted Search Path or Element",
+  "CWE-434": "Unrestricted Upload of File with Dangerous Type",
+  "CWE-436": "Interpretation Conflict",
+  "CWE-441": "Unintended Proxy or Intermediary (Confused Deputy)",
+  "CWE-444": "HTTP Request/Response Smuggling",
+  "CWE-451": "UI Misrepresentation of Critical Information",
+  "CWE-459": "Incomplete Cleanup",
+  "CWE-470": "Unsafe Reflection",
+  "CWE-471": "Modification of Assumed-Immutable Data",
+  "CWE-476": "NULL Pointer Dereference",
+  "CWE-477": "Use of Obsolete Function",
+  "CWE-489": "Active Debug Code",
+  "CWE-494": "Download of Code Without Integrity Check",
+  "CWE-497": "Exposure of Sensitive System Information to an Unauthorized Control Sphere",
+  "CWE-502": "Deserialization of Untrusted Data",
+  "CWE-521": "Weak Password Requirements",
+  "CWE-522": "Insufficiently Protected Credentials",
+  "CWE-523": "Unprotected Transport of Credentials",
+  "CWE-532": "Insertion of Sensitive Information into Log File",
+  "CWE-540": "Inclusion of Sensitive Information in Source Code",
+  "CWE-548": "Exposure of Information Through Directory Listing",
+  "CWE-552": "Files or Directories Accessible to External Parties",
+  "CWE-565": "Reliance on Cookies without Validation and Integrity Checking",
+  "CWE-601": "URL Redirection to Untrusted Site (Open Redirect)",
+  "CWE-610": "Externally Controlled Reference to a Resource in Another Sphere",
+  "CWE-611": "XML External Entity (XXE)",
+  "CWE-613": "Insufficient Session Expiration",
+  "CWE-617": "Reachable Assertion",
+  "CWE-639": "Authorization Bypass Through User-Controlled Key (IDOR)",
+  "CWE-640": "Weak Password Recovery Mechanism for Forgotten Password",
+  "CWE-641": "Improper Restriction of Names for Files and Other Resources",
+  "CWE-643": "XPath Injection",
+  "CWE-645": "Overly Restrictive Account Lockout Mechanism",
+  "CWE-652": "XQuery Injection",
+  "CWE-665": "Improper Initialization",
+  "CWE-668": "Exposure of Resource to Wrong Sphere",
+  "CWE-670": "Always-Incorrect Control Flow Implementation",
+  "CWE-672": "Operation on a Resource after Expiration or Release",
+  "CWE-674": "Uncontrolled Recursion",
+  "CWE-682": "Incorrect Calculation",
+  "CWE-693": "Protection Mechanism Failure",
+  "CWE-697": "Incorrect Comparison",
+  "CWE-704": "Incorrect Type Conversion or Cast",
+  "CWE-732": "Incorrect Permission Assignment for Critical Resource",
+  "CWE-749": "Exposed Dangerous Method or Function",
+  "CWE-754": "Improper Check for Unusual or Exceptional Conditions",
+  "CWE-755": "Improper Handling of Exceptional Conditions",
+  "CWE-763": "Release of Invalid Pointer or Reference",
+  "CWE-770": "Allocation of Resources Without Limits or Throttling",
+  "CWE-772": "Missing Release of Resource after Effective Lifetime",
+  "CWE-776": "XML Entity Expansion (XEE / Billion Laughs)",
+  "CWE-787": "Out-of-bounds Write",
+  "CWE-789": "Memory Allocation with Excessive Size Value",
+  "CWE-798": "Use of Hard-coded Credentials",
+  "CWE-829": "Inclusion of Functionality from Untrusted Control Sphere",
+  "CWE-834": "Excessive Iteration",
+  "CWE-835": "Loop with Unreachable Exit Condition (Infinite Loop)",
+  "CWE-838": "Inappropriate Encoding for Output Context",
+  "CWE-843": "Type Confusion (Access of Resource Using Incompatible Type)",
+  "CWE-862": "Missing Authorization",
+  "CWE-863": "Incorrect Authorization",
+  "CWE-908": "Use of Uninitialized Resource",
+  "CWE-913": "Improper Control of Dynamically-Managed Code Resources",
+  "CWE-915": "Mass Assignment",
+  "CWE-916": "Use of Password Hash With Insufficient Computational Effort",
+  "CWE-917": "Expression Language Injection (EL Injection)",
+  "CWE-918": "Server-Side Request Forgery (SSRF)",
+  "CWE-920": "Improper Restriction of Power Consumption",
+  "CWE-921": "Storage of Sensitive Data in a Mechanism without Access Control",
+  "CWE-924": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel",
+  "CWE-1004": "Sensitive Cookie Without 'HttpOnly' Flag",
+  "CWE-1021": "Improper Restriction of Rendered UI Layers (Clickjacking)",
+  "CWE-1188": "Insecure Default Initialization of Resource",
+  "CWE-1236": "CSV Formula Injection",
+  "CWE-1275": "Sensitive Cookie with Improper SameSite Attribute",
+  "CWE-1284": "Improper Validation of Specified Quantity in Input",
+  "CWE-1321": "Improperly Controlled Modification of Object Prototype (Prototype Pollution)",
+  "CWE-1333": "Inefficient Regular Expression Complexity (ReDoS)"
+}

package/data/eol-mapping.json

@@ -30,5 +30,17 @@
     "org.springframework": { "product": "spring-framework", "label": "Spring Framework" },
     "org.hibernate": { "product": "hibernate", "label": "Hibernate ORM" },
     "io.netty": { "product": "netty", "label": "Netty" }
+  },
+  "by_npm_name": {
+    "angular": { "product": "angularjs", "label": "AngularJS" },
+    "angularjs": { "product": "angularjs", "label": "AngularJS" },
+    "vue": { "product": "vue", "label": "Vue" },
+    "react": { "product": "react", "label": "React" },
+    "react-dom": { "product": "react", "label": "React" },
+    "jquery": { "product": "jquery", "label": "jQuery" },
+    "bootstrap": { "product": "bootstrap", "label": "Bootstrap" }
+  },
+  "by_npm_scope": {
+    "@angular/": { "product": "angular", "label": "Angular" }
   }
 }

package/docs/ARCHITECTURE.md

@@ -21,6 +21,7 @@ lib/retire.js                retire.js (vendored-JS scanner) wrapper + cache + n
 lib/scan-completeness.js     Warnings for deps we couldn't fully resolve.
 lib/npm/parse.js             package.json, package-lock.json (v1/2/3), yarn.lock v1 parsers.
 lib/npm/collect.js           Merge across JS manifests → unified resolvedDeps Map.
+lib/npm/registry.js          npm registry packument query → per-version deprecation + dist-tags.latest.
 lib/cache-archive.js         tar.gz / zip export & import of ~/.fad-checker/.
 lib/config.js                Persistent user config in ~/.fad-checker/config.json (mode 0600).
 data/                        Curated JSON: known-obsolete, eol-mapping, cpe-coord-map, known-public-namespaces.
@@ -77,10 +78,11 @@ The Maven keyspace and npm keyspace never collide — `:lodash` (Maven groupId-l
    - Confirms the dep version actually falls in the vulnerable range (else `cpeFiltered: true` — likely false positive).
    - Upgrades match `confidence` from `possible` → `probable` → `exact` when a curated `cpe-coord-map.json` entry confirms vendor:product → dep coord.
 8. **retire.js** (default on) — shells out to `retire --outputformat json --jspath <src>`. Output normalised to fad-checker match shape, with the vendored file path attached so the report can show where the offending `.js` lives. Cache: `~/.fad-checker/retire-cache/<md5(src)>.json`, 24h TTL.
-9. **EOL / Obsolete / Outdated** — `lib/outdated.js`:
-   - **EOL**: matches dep coord against `data/eol-mapping.json`, fetches the cycle list from endoflife.date (cached 7d), flags cycles past their EOL date.
-   - **Obsolete**: lookup in `data/known-obsolete.json` (curated: log4j 1.x, jackson-mapper-asl, joda-time, commons-httpclient 3.x, …).
-   - **Outdated**: Maven Central Solr query for the latest version. Cache 24h. Concurrency 8.
+9. **EOL / Obsolete / Outdated** — `lib/outdated.js` (Maven) + `lib/npm/registry.js` (npm):
+   - **WebJars** (`org.webjars*` — client-side JS shipped as Maven artifacts) are reduced to their npm-equivalent coordinate by `webjarToNpm()` (`lib/npm/collect.js`): `org.webjars.npm` is a deterministic npm mirror (`angular__core` → `@angular/core`); classic `org.webjars`/bower names pass through. They then flow through the **same npm paths** below — no WebJar-specific data.
+   - **EOL**: matches dep coord against `data/eol-mapping.json`, fetches the cycle list from endoflife.date (cached 7d), flags cycles past their EOL date. npm packages and WebJars resolve by JS library name via `by_npm_name` / `by_npm_scope` (e.g. npm `angular`/webjar `angularjs` → AngularJS 1.x, `@angular/*` → Angular, `react`/`jquery`/`vue`/`bootstrap`).
+   - **Obsolete**: Maven via curated `data/known-obsolete.json` (log4j 1.x, jackson-mapper-asl, joda-time, commons-httpclient 3.x, …); npm **and WebJars** via the registry's per-version `deprecated` field (authoritative maintainer data — every dep is checked, nothing curated, nothing skipped).
+   - **Outdated**: Maven Central Solr query; npm registry `dist-tags.latest` (npm deps and WebJars). Both gated by `--no-all-libs`. Cache 24h. Concurrency 8.
 10. **Snyk** (optional, `--snyk`) — runs `snyk test --all-projects --json` against the cleaned target dir. Normalised + merged. Findings in both sources tagged `source: "both"`.
 11. **Render** — `writeReports()` produces `cve-report.html` (self-contained, inline CSS, no external assets) and `cve-report.doc` (same HTML with Office XML namespace meta tags so Word opens it natively). Default output dir: `./fad-checker-report/`.
 
@@ -129,9 +131,9 @@ The Maven keyspace and npm keyspace never collide — `:lodash` (Maven groupId-l
 
 - The CVE bundle from CVEProject is ~500 MB unpacked. We shell out to `curl + unzip` (Node built-in fallback to `fetch()` + system `unzip` / PowerShell `Expand-Archive`). The extracted JSON is deleted after the index is built.
 - The bundle ships as `cves.zip.zip` (a zip whose sole content is another zip). `extractZip()` recurses up to 3 levels.
-- `endoflife.date` API responses are cached locally for 7 days; Maven Central version lookups for 24 hours.
+- `endoflife.date` API responses are cached locally for 7 days; Maven Central and npm registry version lookups for 24 hours.
 - **Persistent config**: `~/.fad-checker/config.json` (mode 0600) stores per-user state, currently the NVD API key. Set via `fad-checker --set-nvd-key <KEY>`.
-- **`--offline` umbrella flag**: skips every network call (CVE index download, OSV queries, NVD enrichment, endoflife.date lookups, Maven Central version queries, transitive POM fetches, retire.js scans). Falls back to whatever is already cached. Per-source variants (`--cve-offline`, `--no-osv`, `--no-nvd`, `--no-retire`) still work independently.
+- **`--offline` umbrella flag**: skips every network call (CVE index download, OSV queries, NVD enrichment, endoflife.date lookups, Maven Central version queries, npm registry queries, transitive POM fetches, retire.js scans). Falls back to whatever is already cached. Per-source variants (`--cve-offline`, `--no-osv`, `--no-nvd`, `--no-retire`, `--no-js`) still work independently.
 - `snyk` is not a dependency — we shell out via `execFile`. `snyk` exits 1 when it finds vulnerabilities, which is expected (the JSON is still on stdout).
 - The cleaned POM is the union of every profile's deps. Counts will therefore be larger than the source POM. This is intentional — verify your reasoning before "reducing" them.
 - Unresolved `${…}` Maven variables are kept verbatim in the rewritten POM. `lib/cve-match.js` resolves them lazily via `resolveDepVersion()` when collecting deps for the scan. Deps that *still* can't be resolved (external BOM) are surfaced in chapter 0 as `unresolved-versions` warnings.

package/fad-checker.js

@@ -464,6 +464,17 @@ async function runReportFlow(allPomMetadata, allPropsByPom, ecoFlags = {}) {
 		catch (err) { console.warn(chalk.yellow("⚠️  Outdated check skipped:"), err.message); }
 	}
 
+	// 4a. npm registry — deprecation (always, authoritative maintainer data) and
+	// outdated (gated by --all-libs like Maven Central). Covers npm deps and
+	// WebJars (Maven artifacts wrapping npm/bower libs), so it runs even in
+	// Maven-only mode. One fetch per package; no-ops when there are no targets.
+	try {
+		const { checkNpmRegistryDeps } = require("./lib/npm/registry");
+		const npmReg = await checkNpmRegistryDeps(resolved, { verbose, offline, allLibs: options.allLibs });
+		obsoleteResults = obsoleteResults.concat(npmReg.deprecated);
+		outdatedResults = outdatedResults.concat(npmReg.outdated);
+	} catch (err) { console.warn(chalk.yellow("⚠️  npm registry check skipped:"), err.message); }
+
 	// Cross-section dedup: drop entries from outdated that already appear in EOL/Obsolete
 	const eolKeys = new Set(eolResults.map(r => `${r.dep.groupId}:${r.dep.artifactId}`));
 	const obsKeys = new Set(obsoleteResults.map(r => `${r.dep.groupId}:${r.dep.artifactId}`));
@@ -574,16 +585,19 @@ async function runReportFlow(allPomMetadata, allPropsByPom, ecoFlags = {}) {
 		if (retireMatches.length > 10) console.log(`       ... and ${retireMatches.length - 10} more (see report)`);
 	}
 
+	// npm deps have no groupId; show them as "npm:name" rather than ":name".
+	const coordOf = d => d.ecosystem === "npm" ? `npm:${d.artifactId}` : `${d.groupId}:${d.artifactId}`;
+
 	console.log(chalk.bold.cyan("\n  2. End-of-Life Frameworks"));
-	for (const e of eolResults) console.log(`     ${e.product.padEnd(20)} ${e.dep.groupId}:${e.dep.artifactId}:${e.dep.version}  ${e.eol}`);
+	for (const e of eolResults) console.log(`     ${e.product.padEnd(20)} ${coordOf(e.dep)}:${e.dep.version}  ${e.eol}`);
 	if (!eolResults.length) console.log(chalk.gray("     (none)"));
 
 	console.log(chalk.bold.cyan("\n  3. Obsolete / Deprecated Libraries"));
-	for (const o of obsoleteResults) console.log(`     ${(o.severity || "info").padEnd(8)} ${o.dep.groupId}:${o.dep.artifactId}:${o.dep.version}  → ${o.replacement || "n/a"}`);
+	for (const o of obsoleteResults) console.log(`     ${(o.severity || "info").padEnd(8)} ${coordOf(o.dep)}:${o.dep.version}  → ${o.replacement || "n/a"}`);
 	if (!obsoleteResults.length) console.log(chalk.gray("     (none)"));
 
 	console.log(chalk.bold.cyan("\n  4. Outdated Libraries"));
-	for (const o of outdatedResults.slice(0, 20)) console.log(`     ${o.dep.groupId}:${o.dep.artifactId}  ${o.dep.version} → ${o.latest}`);
+	for (const o of outdatedResults.slice(0, 20)) console.log(`     ${coordOf(o.dep)}  ${o.dep.version} → ${o.latest}`);
 	if (outdatedResults.length > 20) console.log(`       ... and ${outdatedResults.length - 20} more`);
 	if (!outdatedResults.length && options.allLibs) console.log(chalk.gray("     (none)"));
 	if (!options.allLibs) console.log(chalk.gray("     (re-run with -a/--allLibs to query Maven Central)"));