fad-checker 1.0.3 → 1.0.5

package/lib/npm/registry.js

@@ -0,0 +1,206 @@
+/**
+ * lib/npm/registry.js — npm registry queries for the npm half of the
+ * EOL/obsolete/outdated story.
+ *
+ * Two authoritative, online signals come from one packument fetch:
+ *   - deprecated: the maintainer's `deprecated` string on the *resolved*
+ *     version (the same data behind `npm WARN deprecated …`).
+ *   - outdated:   `dist-tags.latest` vs. the resolved version.
+ *
+ * The point of querying the registry rather than a curated list is to skip
+ * nothing: every npm dep is checked against the source of truth.
+ *
+ * `packumentToFindings` is the pure extractor (unit-tested without network);
+ * `checkNpmRegistryDeps` is the cached, concurrent driver.
+ */
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+const pLimit = require("p-limit");
+const { semverCompare, webjarToNpm } = require("./collect");
+
+const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
+const CACHE_PATH = path.join(CACHE_DIR, "npm-registry-cache.json");
+const CACHE_MAX_AGE_MS = 24 * 3600 * 1000; // 1 day, aligned with Maven Central
+const REGISTRY = "https://registry.npmjs.org";
+
+function loadCache() {
+	try { return JSON.parse(fs.readFileSync(CACHE_PATH, "utf8")); }
+	catch { return { meta: { fetchedAt: 0 }, entries: {} }; }
+}
+
+function saveCache(data) {
+	try {
+		fs.mkdirSync(CACHE_DIR, { recursive: true });
+		fs.writeFileSync(CACHE_PATH, JSON.stringify(data));
+	} catch { /* ignore */ }
+}
+
+/** Pull a recommended replacement out of a free-form deprecation message. */
+function replacementFromMessage(msg) {
+	if (!msg) return null;
+	const url = msg.match(/https?:\/\/\S+/);
+	if (url) return url[0].replace(/[).,]+$/, "");
+	return "see deprecation notice";
+}
+
+/**
+ * Extract { deprecated, outdated } findings for one dep from its packument.
+ * Pure — no network, no cache. Either field is null when not applicable.
+ */
+function packumentToFindings(packument, dep) {
+	const out = { deprecated: null, outdated: null };
+	if (!packument || typeof packument !== "object") return out;
+
+	const versionEntry = packument.versions?.[dep.version];
+	const depMsg = versionEntry && typeof versionEntry.deprecated === "string"
+		? versionEntry.deprecated.trim()
+		: "";
+	if (depMsg) {
+		out.deprecated = {
+			dep,
+			severity: "MEDIUM",
+			replacement: replacementFromMessage(depMsg),
+			reason: depMsg,
+			source: "npm",
+		};
+	}
+
+	const latest = packument["dist-tags"]?.latest;
+	if (latest && dep.version) {
+		let behind = false;
+		try { behind = semverCompare(dep.version, latest) < 0; }
+		catch { behind = false; }
+		if (behind) {
+			const t = packument.time?.[latest];
+			out.outdated = {
+				dep,
+				latest,
+				releaseDate: typeof t === "string" ? t.slice(0, 10) : null,
+			};
+		}
+	}
+	return out;
+}
+
+/** registry.npmjs.org path-encodes a scoped name's slash. */
+function packumentUrl(name) {
+	return name.startsWith("@")
+		? `${REGISTRY}/${name.replace("/", "%2F")}`
+		: `${REGISTRY}/${encodeURIComponent(name)}`;
+}
+
+async function fetchPackument(name, opts = {}) {
+	if (opts.offline) return null;
+	const timeoutMs = opts.timeoutMs || 15000;
+	try {
+		// Per-request timeout: a single stalled connection must never hang the
+		// whole run (one slow package would otherwise occupy a concurrency slot
+		// forever and starve the pool).
+		const res = await fetch(packumentUrl(name), {
+			headers: { "User-Agent": "fad-checker-npm-registry", Accept: "application/json" },
+			signal: AbortSignal.timeout(timeoutMs),
+		});
+		if (!res.ok) return { error: `HTTP ${res.status}` };
+		return await res.json();
+	} catch (err) {
+		return { error: err.name === "TimeoutError" ? `timeout after ${timeoutMs}ms` : err.message };
+	}
+}
+
+/**
+ * Check every npm dep against the registry.
+ *
+ * Returns { deprecated: [obsolete-shaped], outdated: [outdated-shaped] }.
+ * Deprecation always runs (online); outdated is only collected when allLibs
+ * is set, mirroring the Maven Central outdated gate (--no-all-libs).
+ *
+ * opts: { verbose, offline, allLibs, concurrency = 8 }
+ */
+async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
+	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
+	// Targets = npm deps (queried by their own name) + WebJars (queried by their
+	// derived npm-equivalent name; version matches upstream). The original dep
+	// is kept for display/results so the report shows e.g. org.webjars:angularjs.
+	const targets = [];
+	for (const d of resolvedDeps.values()) {
+		if (!d.version) continue;
+		if (d.ecosystem === "npm") { targets.push({ dep: d, npmName: d.artifactId, version: d.version }); continue; }
+		const wj = webjarToNpm(d);
+		if (wj?.name) targets.push({ dep: d, npmName: wj.name, version: d.version });
+	}
+	const result = { deprecated: [], outdated: [] };
+	if (!targets.length) return result;
+
+	const cache = loadCache();
+	const fresh = cache.meta?.fetchedAt && (Date.now() - cache.meta.fetchedAt) < CACHE_MAX_AGE_MS;
+	if (!fresh && !offline) cache.entries = {};
+
+	const cacheKey = t => `${t.npmName}@${t.version}`;
+	const liveCount = offline ? 0 : targets.filter(t => !cache.entries[cacheKey(t)]).length;
+	if (liveCount && !offline) {
+		console.log(`📦 npm registry: checking ${targets.length} packages for deprecation${allLibs ? " + outdated" : ""} (${liveCount} live, ${targets.length - liveCount} cached)…`);
+	}
+
+	// Incremental progress — fetching ~hundreds/thousands of packuments at
+	// concurrency N would otherwise be total silence for a minute or more.
+	let processed = 0;
+	const startedAt = Date.now();
+	const printProgress = (final = false) => {
+		if (!liveCount) return;
+		const elapsed = Math.round((Date.now() - startedAt) / 1000);
+		const pct = Math.round((processed / targets.length) * 100);
+		const line = `   npm registry: ${processed}/${targets.length} (${pct}%) — ${elapsed}s`;
+		if (process.stdout.isTTY) process.stdout.write(`\r${line}${final ? "\n" : "          "}`);
+		else if (final) console.log(line);
+	};
+
+	const limit = pLimit(concurrency);
+	await Promise.all(targets.map(t => limit(async () => {
+		const { dep, npmName, version } = t;
+		const key = cacheKey(t);
+		let extracted = cache.entries[key];
+		if (!extracted) {
+			const packument = await fetchPackument(npmName, { offline });
+			if (packument && !packument.error) {
+				const f = packumentToFindings(packument, { version });
+				extracted = {
+					deprecated: f.deprecated ? { reason: f.deprecated.reason, replacement: f.deprecated.replacement } : null,
+					latest: f.outdated ? f.outdated.latest : null,
+					latestDate: f.outdated ? f.outdated.releaseDate : null,
+				};
+				cache.entries[key] = extracted;
+			} else {
+				extracted = { deprecated: null, latest: null, latestDate: null, error: packument?.error || "no data" };
+				if (!offline) cache.entries[key] = extracted;
+			}
+		}
+		processed++;
+		if (processed % 25 === 0 || processed === targets.length) printProgress();
+		if (extracted.deprecated) {
+			result.deprecated.push({
+				dep,
+				severity: "MEDIUM",
+				replacement: extracted.deprecated.replacement,
+				reason: extracted.deprecated.reason,
+				source: "npm",
+			});
+			if (verbose) process.stdout.write(`  deprecated: ${npmName}@${version}\n`);
+		}
+		if (allLibs && extracted.latest) {
+			result.outdated.push({ dep, latest: extracted.latest, releaseDate: extracted.latestDate || null });
+			if (verbose) process.stdout.write(`  outdated: ${npmName} ${version} → ${extracted.latest}\n`);
+		}
+	})));
+	if (liveCount) printProgress(true);
+
+	cache.meta = { fetchedAt: Date.now() };
+	saveCache(cache);
+
+	result.deprecated.sort((a, b) => a.dep.artifactId.localeCompare(b.dep.artifactId));
+	result.outdated.sort((a, b) => a.dep.artifactId.localeCompare(b.dep.artifactId));
+	if (liveCount && !offline) console.log(`   npm registry: ${result.deprecated.length} deprecated, ${result.outdated.length} outdated`);
+	return result;
+}
+
+module.exports = { packumentToFindings, checkNpmRegistryDeps, replacementFromMessage };

package/lib/nvd.js

@@ -18,6 +18,10 @@ const { getNvdApiKey } = require("./config");
 
 const NVD_CACHE_DIR = path.join(os.homedir(), ".fad-checker", "nvd-cache");
 const NVD_CACHE_TTL_MS = 7 * 24 * 3600 * 1000;
+// Bump whenever `extractFromNvdRecord` adds a new field — pre-bump cache
+// entries are treated as cache-miss so we re-fetch and pick up the new field.
+// 2: added `cwes` (Common Weakness Enumeration list).
+const NVD_CACHE_SCHEMA = 2;
 const NVD_BASE = "https://services.nvd.nist.gov/rest/json/cves/2.0";
 
 function getRateDelay() {
@@ -43,6 +47,8 @@ function readCache(cveId) {
 	if (!fs.existsSync(p)) return null;
 	try {
 		const data = JSON.parse(fs.readFileSync(p, "utf8"));
+		// Schema mismatch → force re-fetch so newly-added fields (e.g. cwes) get populated.
+		if ((data._schema || 1) < NVD_CACHE_SCHEMA) return null;
 		if (Date.now() - data._fetchedAt < NVD_CACHE_TTL_MS) return data.body;
 	} catch { /* ignore */ }
 	return null;
@@ -50,7 +56,7 @@ function readCache(cveId) {
 
 function writeCache(cveId, body) {
 	fs.mkdirSync(NVD_CACHE_DIR, { recursive: true });
-	fs.writeFileSync(cachePath(cveId), JSON.stringify({ _fetchedAt: Date.now(), body }));
+	fs.writeFileSync(cachePath(cveId), JSON.stringify({ _schema: NVD_CACHE_SCHEMA, _fetchedAt: Date.now(), body }));
 }
 
 function bestMetric(metrics) {

package/lib/outdated.js

@@ -9,6 +9,7 @@ const fs = require("fs");
 const path = require("path");
 const os = require("os");
 const { compareMavenVersions } = require("./maven-version");
+const { webjarToNpm } = require("./npm/collect");
 
 const KNOWN_OBSOLETE = require("../data/known-obsolete.json");
 const EOL_MAPPING = require("../data/eol-mapping.json");
@@ -39,6 +40,23 @@ function isEolCacheFresh(maxAge = EOL_CACHE_MAX_AGE_MS) {
 // -------- EOL via endoflife.date --------
 
 function findEolProduct(dep) {
+	// npm packages — and WebJars, which are client-side JS shipped as Maven
+	// artifacts — resolve by JS library name, not Maven coordinate. npm deps
+	// use their name directly; WebJars are reduced to their npm-equivalent name
+	// first (org.webjars:angularjs → "angularjs", org.webjars.npm:angular__core
+	// → "@angular/core"). The npm package literally named "angular" is AngularJS
+	// 1.x; modern Angular is the @angular/* scope — hence the name vs. scope maps.
+	const npmName = dep.ecosystem === "npm" ? (dep.artifactId || "") : webjarToNpm(dep)?.name;
+	if (npmName != null) {
+		const byName = EOL_MAPPING.by_npm_name?.[npmName];
+		if (byName) return byName;
+		const scopes = Object.keys(EOL_MAPPING.by_npm_scope || {})
+			.sort((a, b) => b.length - a.length);
+		for (const s of scopes) {
+			if (npmName.startsWith(s)) return EOL_MAPPING.by_npm_scope[s];
+		}
+		return null;
+	}
 	const key = `${dep.groupId}:${dep.artifactId}`;
 	const direct = EOL_MAPPING.by_group_artifact?.[key];
 	if (direct) return direct;
@@ -104,7 +122,6 @@ async function checkEolDeps(resolvedDeps, opts = {}) {
 	const seen = new Set();
 
 	for (const dep of resolvedDeps.values()) {
-		if (dep.ecosystem === "npm") continue; // EOL mapping is Maven-only for now
 		const product = findEolProduct(dep);
 		if (!product) continue;
 		const dedupeKey = `${dep.groupId}:${dep.artifactId}|${product.product}`;

package/package.json

@@ -1,14 +1,15 @@
 {
   "name": "fad-checker",
-  "version": "1.0.3",
-  "description": "Fucking Autonomous Dependency Checker — multi-ecosystem CVE / EOL / outdated / vendored-JS scanner for Maven, npm and Yarn monorepos. Self-contained HTML + Word report.",
+  "version": "1.0.5",
+  "description": "Fucking Autonomous Dependency Checker — Scans ALL pom/bom, npm/Yarn stuff and vendored JavaScript in a source tree, deal with private deps, multi modules & produces 1 HTML/DOC report with CVE, EOL, obsolete, outdated deps & fix recos",
   "license": "MIT",
-  "author": "N8tz <n8tz.js@gmail.com>",
+  "repository": "https://github.com/n8tz/fad-checker",
+  "author": "pp9Ping <pp9Ping@gmail.com>",
   "maintainers": [
-    "Nathan Braun <n8tz.js@gmail.com>"
+    "pp9Ping <pp9Ping@gmail.com>"
   ],
   "contributors": [
-    "N8tz (https://github.com/N8tz)"
+    "pp9Ping <pp9Ping@gmail.com>"
   ],
   "bin": {
     "fad-checker": "fad-checker.js",

package/test/cve-report.test.js

@@ -60,6 +60,98 @@ test("generateWordReport contains Word XML namespaces", () => {
 	assert.ok(doc.includes("Word.Document"));
 });
 
+test("generateHtmlReport wraps tables with copy buttons", () => {
+	const html = generateHtmlReport({
+		cveMatches: sampleMatches,
+		eolResults: [], obsoleteResults: [], outdatedResults: [],
+		projectInfo,
+	});
+	// Wrapper div + copy button injected around every table
+	assert.ok(html.includes('class="table-wrap"'), "should wrap tables");
+	assert.ok(html.includes('class="btn-copy"'), "should have copy buttons");
+	assert.ok(html.includes("📋 Copy table"), "button label");
+	// Copy script wired up
+	assert.ok(html.includes("navigator.clipboard"), "should include clipboard script");
+	assert.ok(html.includes("inlineStylesForWord"), "should inline styles for Word paste");
+});
+
+test("generateWordReport does NOT wrap tables (no copy buttons in .doc)", () => {
+	const doc = generateWordReport({
+		cveMatches: sampleMatches,
+		eolResults: [], obsoleteResults: [], outdatedResults: [],
+		projectInfo,
+	});
+	assert.ok(!doc.includes('class="table-wrap"'), "no wrapper in Word output");
+	assert.ok(!doc.includes('class="btn-copy"'), "no copy buttons in Word output");
+});
+
+test("CWE human names are shown in the CVE table and detail panel", () => {
+	const html = generateHtmlReport({
+		cveMatches: sampleMatches.map(m => ({
+			...m,
+			cve: { ...m.cve, cwes: ["CWE-502", "CWE-917"] },
+		})),
+		eolResults: [], obsoleteResults: [], outdatedResults: [],
+		projectInfo,
+	});
+	// Detail panel: full name inline
+	assert.ok(html.includes("Deserialization of Untrusted Data"), "CWE-502 name in panel");
+	assert.ok(html.includes("Expression Language Injection"), "CWE-917 name in panel");
+	// Tooltip on the column link
+	assert.ok(html.includes('title="CWE-502: Deserialization of Untrusted Data"'), "tooltip");
+	// Weaknesses section in detail panel
+	assert.ok(html.includes("Weaknesses (CWE)"), "weaknesses section heading");
+	assert.ok(html.includes('class="cwe-list"'), "CWE list rendered");
+});
+
+test("Executive summary surfaces primary CWE name on each preview row", () => {
+	const html = generateHtmlReport({
+		cveMatches: [{
+			dep: { groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.14.0", scope: "compile" },
+			cve: { id: "CVE-2021-44228", severity: "CRITICAL", score: 10, description: "Log4Shell", fixVersion: "2.15.0", cwes: ["CWE-502", "CWE-917"] },
+			confidence: "exact",
+		}],
+		eolResults: [], obsoleteResults: [], outdatedResults: [],
+		projectInfo,
+	});
+	assert.ok(html.includes('class="exec-cwe"'), "exec-cwe chip in summary");
+	assert.ok(html.includes('class="exec-cwe-id">CWE-502'), "id in chip");
+	assert.ok(html.includes("Deserialization of Untrusted Data"), "human name in chip");
+});
+
+test("Unknown CWE falls back to id-only display", () => {
+	const html = generateHtmlReport({
+		cveMatches: [{
+			dep: { groupId: "x", artifactId: "y", version: "1", scope: "compile" },
+			cve: { id: "CVE-2099-9999", severity: "HIGH", description: "n/a", cwes: ["CWE-99999"] },
+		}],
+		eolResults: [], obsoleteResults: [], outdatedResults: [],
+		projectInfo,
+	});
+	assert.ok(html.includes("CWE-99999"), "unknown CWE id present");
+	assert.ok(html.includes("(unknown weakness)"), "fallback label for unknown CWE in detail panel");
+});
+
+test("generateWordReport applies width:100% to every table for Word page-fit", () => {
+	const doc = generateWordReport({
+		cveMatches: sampleMatches,
+		eolResults: [], obsoleteResults: [], outdatedResults: [],
+		projectInfo,
+	});
+	// Every <table> rewritten with width="100%" + inline style (incl. fixed table-layout)
+	assert.ok(doc.includes('width="100%"'), "tables get width=100% attribute");
+	assert.ok(doc.includes("table-layout:fixed"), "tables get fixed layout");
+	// Word section + landscape page setup
+	assert.ok(doc.includes('class="WordSection1"'), "WordSection1 wrapper");
+	assert.ok(doc.includes("mso-page-orientation: landscape"), "landscape declared via mso-* property");
+	assert.ok(doc.includes("29.7cm 21cm"), "explicit A4 landscape dimensions");
+	// MSO conditional comment block with twips-based <w:sectPr> equivalent
+	assert.ok(doc.includes("w:WordDocument"), "Word document XML block");
+	assert.ok(doc.includes("16838twips"), "twips-based page size in mso conditional");
+	// Colgroups injected so fixed-layout tables have deterministic column widths
+	assert.ok(doc.includes('<colgroup>'), "colgroup injected on tables");
+});
+
 test("writeReports writes both files to disk", async () => {
 	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "fad-checker-rep-"));
 	const r = await writeReports({

package/test/npm-registry.test.js

@@ -0,0 +1,64 @@
+const { test } = require("node:test");
+const assert = require("node:assert/strict");
+const { packumentToFindings } = require("../lib/npm/registry");
+
+const dep = (name, version) => ({ ecosystem: "npm", groupId: "", artifactId: name, version });
+
+test("packumentToFindings flags a deprecated resolved version", () => {
+	const packument = {
+		name: "request",
+		"dist-tags": { latest: "2.88.2" },
+		versions: {
+			"2.88.2": { deprecated: "request has been deprecated, see https://github.com/request/request/issues/3142" },
+		},
+		time: { "2.88.2": "2020-02-11T00:00:00.000Z" },
+	};
+	const { deprecated, outdated } = packumentToFindings(packument, dep("request", "2.88.2"));
+	assert.ok(deprecated, "should return a deprecated finding");
+	assert.match(deprecated.reason, /has been deprecated/);
+	assert.equal(deprecated.source, "npm");
+	assert.equal(deprecated.dep.artifactId, "request");
+	// Latest === current, so not outdated.
+	assert.equal(outdated, null);
+});
+
+test("packumentToFindings extracts a replacement URL from the deprecation message", () => {
+	const packument = {
+		"dist-tags": { latest: "1.0.0" },
+		versions: { "1.0.0": { deprecated: "use the foo package instead, see https://example.com/why" } },
+	};
+	const { deprecated } = packumentToFindings(packument, dep("bar", "1.0.0"));
+	assert.equal(deprecated.replacement, "https://example.com/why");
+});
+
+test("packumentToFindings reports outdated when latest is newer", () => {
+	const packument = {
+		"dist-tags": { latest: "3.7.1" },
+		versions: { "3.6.0": {} },
+		time: { "3.7.1": "2023-08-28T00:00:00.000Z" },
+	};
+	const { deprecated, outdated } = packumentToFindings(packument, dep("jquery", "3.6.0"));
+	assert.equal(deprecated, null, "not deprecated");
+	assert.ok(outdated, "should be outdated");
+	assert.equal(outdated.latest, "3.7.1");
+	assert.equal(outdated.releaseDate, "2023-08-28");
+});
+
+test("packumentToFindings returns nothing for an up-to-date, non-deprecated dep", () => {
+	const packument = {
+		"dist-tags": { latest: "4.18.2" },
+		versions: { "4.18.2": {} },
+	};
+	const { deprecated, outdated } = packumentToFindings(packument, dep("express", "4.18.2"));
+	assert.equal(deprecated, null);
+	assert.equal(outdated, null);
+});
+
+test("packumentToFindings tolerates a missing version entry", () => {
+	// Resolved version not present in the registry (e.g. unpublished) — must not throw.
+	const packument = { "dist-tags": { latest: "2.0.0" }, versions: { "2.0.0": {} } };
+	const { deprecated, outdated } = packumentToFindings(packument, dep("ghost", "1.5.0"));
+	assert.equal(deprecated, null);
+	assert.ok(outdated, "1.5.0 < 2.0.0 so still outdated");
+	assert.equal(outdated.latest, "2.0.0");
+});

package/test/outdated.test.js

@@ -54,3 +54,48 @@ test("findEolProduct picks longest prefix match", () => {
 	assert.equal(sec.product, "spring-framework");
 	assert.equal(sec.label, "Spring Security");
 });
+
+test("findEolProduct maps the npm 'angular' package to AngularJS 1.x", () => {
+	// The literal npm package named "angular" IS AngularJS (1.x), EOL since 2022.
+	const a = findEolProduct({ ecosystem: "npm", groupId: "", artifactId: "angular" });
+	assert.equal(a.product, "angularjs");
+	assert.equal(a.label, "AngularJS");
+});
+
+test("findEolProduct maps @angular/* scoped packages to modern Angular", () => {
+	const core = findEolProduct({ ecosystem: "npm", groupId: "", artifactId: "@angular/core" });
+	assert.equal(core.product, "angular");
+	const router = findEolProduct({ ecosystem: "npm", groupId: "", artifactId: "@angular/router" });
+	assert.equal(router.product, "angular");
+});
+
+test("findEolProduct maps react / react-dom / jquery / vue / bootstrap", () => {
+	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "react" }).product, "react");
+	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "react-dom" }).product, "react");
+	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "jquery" }).product, "jquery");
+	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "vue" }).product, "vue");
+	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "bootstrap" }).product, "bootstrap");
+});
+
+test("findEolProduct returns null for an unmapped npm package", () => {
+	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "left-pad" }), null);
+	// A Maven groupId must never leak into the npm lookup.
+	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "org.springframework" }), null);
+});
+
+test("findEolProduct maps WebJars (client-side JS shipped as Maven artifacts)", () => {
+	// org.webjars:angularjs:1.8.3 — AngularJS 1.x, EOL since 2021.
+	const ajs = findEolProduct({ groupId: "org.webjars", artifactId: "angularjs", version: "1.8.3" });
+	assert.ok(ajs, "org.webjars:angularjs must map");
+	assert.equal(ajs.product, "angularjs");
+
+	assert.equal(findEolProduct({ groupId: "org.webjars", artifactId: "jquery" }).product, "jquery");
+	assert.equal(findEolProduct({ groupId: "org.webjars", artifactId: "bootstrap" }).product, "bootstrap");
+	// org.webjars.npm mirrors npm names; scope slash is encoded as "__".
+	assert.equal(findEolProduct({ groupId: "org.webjars.npm", artifactId: "vue" }).product, "vue");
+	assert.equal(findEolProduct({ groupId: "org.webjars.npm", artifactId: "angular__core" }).product, "angular");
+});
+
+test("findEolProduct returns null for an unmapped WebJar artifact", () => {
+	assert.equal(findEolProduct({ groupId: "org.webjars", artifactId: "datatables" }), null);
+});

package/test/webjar.test.js

@@ -0,0 +1,33 @@
+const { test } = require("node:test");
+const assert = require("node:assert/strict");
+const { webjarToNpm } = require("../lib/npm/collect");
+
+test("webjarToNpm derives the npm name from org.webjars.npm (deterministic mirror)", () => {
+	assert.deepEqual(
+		webjarToNpm({ groupId: "org.webjars.npm", artifactId: "react", version: "18.2.0" }),
+		{ name: "react", version: "18.2.0" },
+	);
+	// Scoped packages encode "@scope/name" as "scope__name".
+	assert.deepEqual(
+		webjarToNpm({ groupId: "org.webjars.npm", artifactId: "angular__core", version: "17.2.3" }),
+		{ name: "@angular/core", version: "17.2.3" },
+	);
+});
+
+test("webjarToNpm passes classic org.webjars artifactIds through as-is", () => {
+	// Classic WebJars are hand-curated; the artifactId is the JS lib name.
+	assert.deepEqual(
+		webjarToNpm({ groupId: "org.webjars", artifactId: "angularjs", version: "1.8.3" }),
+		{ name: "angularjs", version: "1.8.3" },
+	);
+	assert.equal(webjarToNpm({ groupId: "org.webjars", artifactId: "jquery", version: "3.7.1" }).name, "jquery");
+});
+
+test("webjarToNpm handles bower webjars too", () => {
+	assert.equal(webjarToNpm({ groupId: "org.webjars.bowergithub.foo", artifactId: "bar", version: "1.0.0" }).name, "bar");
+});
+
+test("webjarToNpm returns null for non-webjar coordinates", () => {
+	assert.equal(webjarToNpm({ groupId: "org.springframework", artifactId: "spring-core", version: "6.0.0" }), null);
+	assert.equal(webjarToNpm({ ecosystem: "npm", groupId: "", artifactId: "react", version: "18.0.0" }), null);
+});