fad-checker 1.0.4 → 1.0.5

package/CLAUDE.md

@@ -15,7 +15,7 @@ Code-level orientation for contributors and Claude Code sessions on this repo.
    - retire.js (vendored JS signatures),
    - optionally Snyk (`--snyk`).
 4. Cross-checks every match's NVD CPE configurations against the dep version (`lib/cpe.js`) to filter false positives.
-5. Reports EOL frameworks (endoflife.date), obsolete libs (curated), outdated libs (Maven Central).
+5. Reports EOL frameworks (endoflife.date — Maven & npm), obsolete libs (curated Maven + npm-registry per-version `deprecated` field — authoritative, skips nothing), outdated libs (Maven Central + npm registry `dist-tags.latest`). **WebJars** (`org.webjars*`) are reduced to their npm coordinate by `webjarToNpm()` and run through the npm EOL/deprecation/outdated paths — so e.g. `org.webjars:angularjs:1.8.3` is flagged EOL.
 6. Produces a self-contained HTML report + Word-compatible `.doc`, organised by ecosystem and by defining manifest, with per-tool fix recipes and an executive summary.
 
 No build tool (`mvn`, `npm install`, `yarn`) is required on PATH — `pom.xml` / `package-lock.json` / `yarn.lock` are parsed directly.
@@ -67,6 +67,7 @@ lib/retire.js                retire.js (vendored-JS scanner) wrapper + cache + n
 lib/scan-completeness.js     Warnings for deps fad-checker couldn't fully resolve.
 lib/npm/parse.js             package.json, package-lock.json (v1/2/3), yarn.lock v1 parsers.
 lib/npm/collect.js           Merge across JS manifests → unified resolvedDeps Map.
+lib/npm/registry.js          npm registry packument query → per-version deprecation + dist-tags.latest (npm EOL feeds via lib/outdated.js).
 lib/cache-archive.js         tar.gz / zip export & import of ~/.fad-checker/.
 lib/config.js                Persistent user config in ~/.fad-checker/config.json (mode 0600).
 data/                        known-obsolete.json, eol-mapping.json, cpe-coord-map.json, known-public-namespaces.json
@@ -106,7 +107,7 @@ Test fixtures live in `test/fixtures/`:
 - CVE bundle from CVEProject is ~500 MB unpacked. Shells out to `curl + unzip` (fallback to `fetch()` + `unzip` / `Expand-Archive`). Extracted JSON deleted after index build. Ships as `cves.zip.zip` (nested zip) — `extractZip()` recurses up to 3 levels.
 - `endoflife.date` API responses cached 7 days; Maven Central version lookups cached 24 hours. Cache lives in `~/.fad-checker/`.
 - **Persistent config**: `~/.fad-checker/config.json` (mode 0600). Set NVD key via `fad-checker --set-nvd-key <KEY>` (free, instant from <https://nvd.nist.gov/developers/request-an-api-key> — bumps rate limit from 5/30s to 50/30s).
-- **`--offline` umbrella flag**: skips every network call (CVE/OSV/NVD/Maven Central/endoflife/retire). Falls back to whatever is already cached. Per-source variants (`--cve-offline`, `--no-osv`, `--no-nvd`, `--no-retire`, `--no-transitive`) still work independently.
+- **`--offline` umbrella flag**: skips every network call (CVE/OSV/NVD/Maven Central/endoflife/npm-registry/retire). Falls back to whatever is already cached. Per-source variants (`--cve-offline`, `--no-osv`, `--no-nvd`, `--no-retire`, `--no-transitive`, `--no-js`) still work independently. npm registry deprecation always runs when online; npm (and Maven) outdated is gated by `--no-all-libs`.
 - `snyk` is not a hard dep — shells out via `execFile`. `snyk` exits 1 on findings; the JSON is still on stdout.
 - The cleaned POM is the union of every profile's deps. Counts will be larger than the source POM. Intentional — don't "fix" that.
 - Unresolved `${…}` Maven variables stay verbatim in the rewritten POM. `lib/cve-match.js` resolves them lazily via `resolveDepVersion()` when scanning. Deps that *still* can't be resolved (external BOM not in source tree) surface in chapter 0 as `unresolved-versions` warnings.
@@ -122,5 +123,6 @@ Test fixtures live in `test/fixtures/`:
 | NVD CVE record | `~/.fad-checker/nvd-cache/<cveId>.json` | 7 d |
 | endoflife.date cycles | `~/.fad-checker/eol-cache.json` | 7 d |
 | Maven Central latest | `~/.fad-checker/version-cache.json` | 24 h |
+| npm registry (deprecation + latest) | `~/.fad-checker/npm-registry-cache.json` | 24 h |
 | Transitive POM | `~/.fad-checker/poms-cache/<g>__<a>__<v>.pom` | ∞ (immutable on Maven Central) |
 | retire.js findings | `~/.fad-checker/retire-cache/<md5(src)>.json` | 24 h |

package/data/eol-mapping.json

@@ -30,5 +30,17 @@
     "org.springframework": { "product": "spring-framework", "label": "Spring Framework" },
     "org.hibernate": { "product": "hibernate", "label": "Hibernate ORM" },
     "io.netty": { "product": "netty", "label": "Netty" }
+  },
+  "by_npm_name": {
+    "angular": { "product": "angularjs", "label": "AngularJS" },
+    "angularjs": { "product": "angularjs", "label": "AngularJS" },
+    "vue": { "product": "vue", "label": "Vue" },
+    "react": { "product": "react", "label": "React" },
+    "react-dom": { "product": "react", "label": "React" },
+    "jquery": { "product": "jquery", "label": "jQuery" },
+    "bootstrap": { "product": "bootstrap", "label": "Bootstrap" }
+  },
+  "by_npm_scope": {
+    "@angular/": { "product": "angular", "label": "Angular" }
   }
 }

package/docs/ARCHITECTURE.md

@@ -21,6 +21,7 @@ lib/retire.js                retire.js (vendored-JS scanner) wrapper + cache + n
 lib/scan-completeness.js     Warnings for deps we couldn't fully resolve.
 lib/npm/parse.js             package.json, package-lock.json (v1/2/3), yarn.lock v1 parsers.
 lib/npm/collect.js           Merge across JS manifests → unified resolvedDeps Map.
+lib/npm/registry.js          npm registry packument query → per-version deprecation + dist-tags.latest.
 lib/cache-archive.js         tar.gz / zip export & import of ~/.fad-checker/.
 lib/config.js                Persistent user config in ~/.fad-checker/config.json (mode 0600).
 data/                        Curated JSON: known-obsolete, eol-mapping, cpe-coord-map, known-public-namespaces.
@@ -77,10 +78,11 @@ The Maven keyspace and npm keyspace never collide — `:lodash` (Maven groupId-l
    - Confirms the dep version actually falls in the vulnerable range (else `cpeFiltered: true` — likely false positive).
    - Upgrades match `confidence` from `possible` → `probable` → `exact` when a curated `cpe-coord-map.json` entry confirms vendor:product → dep coord.
 8. **retire.js** (default on) — shells out to `retire --outputformat json --jspath <src>`. Output normalised to fad-checker match shape, with the vendored file path attached so the report can show where the offending `.js` lives. Cache: `~/.fad-checker/retire-cache/<md5(src)>.json`, 24h TTL.
-9. **EOL / Obsolete / Outdated** — `lib/outdated.js`:
-   - **EOL**: matches dep coord against `data/eol-mapping.json`, fetches the cycle list from endoflife.date (cached 7d), flags cycles past their EOL date.
-   - **Obsolete**: lookup in `data/known-obsolete.json` (curated: log4j 1.x, jackson-mapper-asl, joda-time, commons-httpclient 3.x, …).
-   - **Outdated**: Maven Central Solr query for the latest version. Cache 24h. Concurrency 8.
+9. **EOL / Obsolete / Outdated** — `lib/outdated.js` (Maven) + `lib/npm/registry.js` (npm):
+   - **WebJars** (`org.webjars*` — client-side JS shipped as Maven artifacts) are reduced to their npm-equivalent coordinate by `webjarToNpm()` (`lib/npm/collect.js`): `org.webjars.npm` is a deterministic npm mirror (`angular__core` → `@angular/core`); classic `org.webjars`/bower names pass through. They then flow through the **same npm paths** below — no WebJar-specific data.
+   - **EOL**: matches dep coord against `data/eol-mapping.json`, fetches the cycle list from endoflife.date (cached 7d), flags cycles past their EOL date. npm packages and WebJars resolve by JS library name via `by_npm_name` / `by_npm_scope` (e.g. npm `angular`/webjar `angularjs` → AngularJS 1.x, `@angular/*` → Angular, `react`/`jquery`/`vue`/`bootstrap`).
+   - **Obsolete**: Maven via curated `data/known-obsolete.json` (log4j 1.x, jackson-mapper-asl, joda-time, commons-httpclient 3.x, …); npm **and WebJars** via the registry's per-version `deprecated` field (authoritative maintainer data — every dep is checked, nothing curated, nothing skipped).
+   - **Outdated**: Maven Central Solr query; npm registry `dist-tags.latest` (npm deps and WebJars). Both gated by `--no-all-libs`. Cache 24h. Concurrency 8.
 10. **Snyk** (optional, `--snyk`) — runs `snyk test --all-projects --json` against the cleaned target dir. Normalised + merged. Findings in both sources tagged `source: "both"`.
 11. **Render** — `writeReports()` produces `cve-report.html` (self-contained, inline CSS, no external assets) and `cve-report.doc` (same HTML with Office XML namespace meta tags so Word opens it natively). Default output dir: `./fad-checker-report/`.
 
@@ -129,9 +131,9 @@ The Maven keyspace and npm keyspace never collide — `:lodash` (Maven groupId-l
 
 - The CVE bundle from CVEProject is ~500 MB unpacked. We shell out to `curl + unzip` (Node built-in fallback to `fetch()` + system `unzip` / PowerShell `Expand-Archive`). The extracted JSON is deleted after the index is built.
 - The bundle ships as `cves.zip.zip` (a zip whose sole content is another zip). `extractZip()` recurses up to 3 levels.
-- `endoflife.date` API responses are cached locally for 7 days; Maven Central version lookups for 24 hours.
+- `endoflife.date` API responses are cached locally for 7 days; Maven Central and npm registry version lookups for 24 hours.
 - **Persistent config**: `~/.fad-checker/config.json` (mode 0600) stores per-user state, currently the NVD API key. Set via `fad-checker --set-nvd-key <KEY>`.
-- **`--offline` umbrella flag**: skips every network call (CVE index download, OSV queries, NVD enrichment, endoflife.date lookups, Maven Central version queries, transitive POM fetches, retire.js scans). Falls back to whatever is already cached. Per-source variants (`--cve-offline`, `--no-osv`, `--no-nvd`, `--no-retire`) still work independently.
+- **`--offline` umbrella flag**: skips every network call (CVE index download, OSV queries, NVD enrichment, endoflife.date lookups, Maven Central version queries, npm registry queries, transitive POM fetches, retire.js scans). Falls back to whatever is already cached. Per-source variants (`--cve-offline`, `--no-osv`, `--no-nvd`, `--no-retire`, `--no-js`) still work independently.
 - `snyk` is not a dependency — we shell out via `execFile`. `snyk` exits 1 when it finds vulnerabilities, which is expected (the JSON is still on stdout).
 - The cleaned POM is the union of every profile's deps. Counts will therefore be larger than the source POM. This is intentional — verify your reasoning before "reducing" them.
 - Unresolved `${…}` Maven variables are kept verbatim in the rewritten POM. `lib/cve-match.js` resolves them lazily via `resolveDepVersion()` when collecting deps for the scan. Deps that *still* can't be resolved (external BOM) are surfaced in chapter 0 as `unresolved-versions` warnings.

package/fad-checker.js

@@ -464,6 +464,17 @@ async function runReportFlow(allPomMetadata, allPropsByPom, ecoFlags = {}) {
 		catch (err) { console.warn(chalk.yellow("⚠️  Outdated check skipped:"), err.message); }
 	}
 
+	// 4a. npm registry — deprecation (always, authoritative maintainer data) and
+	// outdated (gated by --all-libs like Maven Central). Covers npm deps and
+	// WebJars (Maven artifacts wrapping npm/bower libs), so it runs even in
+	// Maven-only mode. One fetch per package; no-ops when there are no targets.
+	try {
+		const { checkNpmRegistryDeps } = require("./lib/npm/registry");
+		const npmReg = await checkNpmRegistryDeps(resolved, { verbose, offline, allLibs: options.allLibs });
+		obsoleteResults = obsoleteResults.concat(npmReg.deprecated);
+		outdatedResults = outdatedResults.concat(npmReg.outdated);
+	} catch (err) { console.warn(chalk.yellow("⚠️  npm registry check skipped:"), err.message); }
+
 	// Cross-section dedup: drop entries from outdated that already appear in EOL/Obsolete
 	const eolKeys = new Set(eolResults.map(r => `${r.dep.groupId}:${r.dep.artifactId}`));
 	const obsKeys = new Set(obsoleteResults.map(r => `${r.dep.groupId}:${r.dep.artifactId}`));
@@ -574,16 +585,19 @@ async function runReportFlow(allPomMetadata, allPropsByPom, ecoFlags = {}) {
 		if (retireMatches.length > 10) console.log(`       ... and ${retireMatches.length - 10} more (see report)`);
 	}
 
+	// npm deps have no groupId; show them as "npm:name" rather than ":name".
+	const coordOf = d => d.ecosystem === "npm" ? `npm:${d.artifactId}` : `${d.groupId}:${d.artifactId}`;
+
 	console.log(chalk.bold.cyan("\n  2. End-of-Life Frameworks"));
-	for (const e of eolResults) console.log(`     ${e.product.padEnd(20)} ${e.dep.groupId}:${e.dep.artifactId}:${e.dep.version}  ${e.eol}`);
+	for (const e of eolResults) console.log(`     ${e.product.padEnd(20)} ${coordOf(e.dep)}:${e.dep.version}  ${e.eol}`);
 	if (!eolResults.length) console.log(chalk.gray("     (none)"));
 
 	console.log(chalk.bold.cyan("\n  3. Obsolete / Deprecated Libraries"));
-	for (const o of obsoleteResults) console.log(`     ${(o.severity || "info").padEnd(8)} ${o.dep.groupId}:${o.dep.artifactId}:${o.dep.version}  → ${o.replacement || "n/a"}`);
+	for (const o of obsoleteResults) console.log(`     ${(o.severity || "info").padEnd(8)} ${coordOf(o.dep)}:${o.dep.version}  → ${o.replacement || "n/a"}`);
 	if (!obsoleteResults.length) console.log(chalk.gray("     (none)"));
 
 	console.log(chalk.bold.cyan("\n  4. Outdated Libraries"));
-	for (const o of outdatedResults.slice(0, 20)) console.log(`     ${o.dep.groupId}:${o.dep.artifactId}  ${o.dep.version} → ${o.latest}`);
+	for (const o of outdatedResults.slice(0, 20)) console.log(`     ${coordOf(o.dep)}  ${o.dep.version} → ${o.latest}`);
 	if (outdatedResults.length > 20) console.log(`       ... and ${outdatedResults.length - 20} more`);
 	if (!outdatedResults.length && options.allLibs) console.log(chalk.gray("     (none)"));
 	if (!options.allLibs) console.log(chalk.gray("     (re-run with -a/--allLibs to query Maven Central)"));

package/lib/npm/collect.js

@@ -199,6 +199,30 @@ function safeParse(fn, file, verbose) {
 	}
 }
 
+/**
+ * WebJars are client-side JS libraries shipped as Maven artifacts. Derive the
+ * upstream npm coordinate from a WebJar dep so it can flow through the npm
+ * pipeline (registry deprecation/outdated + endoflife EOL) instead of being
+ * special-cased.
+ *
+ *   org.webjars.npm  — deterministic npm mirror. artifactId == npm name;
+ *                      a scoped "@scope/name" is encoded as "scope__name".
+ *   org.webjars      — hand-curated catalogue; artifactId is the JS lib name
+ *                      (mostly aligned with npm, e.g. jquery/bootstrap).
+ *   org.webjars.bower* — Bower mirrors; best-effort name match.
+ *
+ * Versions match the upstream package. Returns { name, version } or null for a
+ * non-WebJar coordinate.
+ */
+function webjarToNpm(dep) {
+	const g = dep.groupId || "";
+	if (g !== "org.webjars" && !g.startsWith("org.webjars.")) return null;
+	let name = dep.artifactId || "";
+	if (!name) return null;
+	if (name.includes("__")) name = "@" + name.replace(/__/g, "/");
+	return { name, version: dep.version || null };
+}
+
 function hasJsManifests(rootDir) {
 	try {
 		const stack = [rootDir];
@@ -221,4 +245,4 @@ function hasJsManifests(rootDir) {
 	return false;
 }
 
-module.exports = { collectNpmDeps, hasJsManifests };
+module.exports = { collectNpmDeps, hasJsManifests, semverCompare, webjarToNpm };

package/lib/npm/registry.js

@@ -0,0 +1,206 @@
+/**
+ * lib/npm/registry.js — npm registry queries for the npm half of the
+ * EOL/obsolete/outdated story.
+ *
+ * Two authoritative, online signals come from one packument fetch:
+ *   - deprecated: the maintainer's `deprecated` string on the *resolved*
+ *     version (the same data behind `npm WARN deprecated …`).
+ *   - outdated:   `dist-tags.latest` vs. the resolved version.
+ *
+ * The point of querying the registry rather than a curated list is to skip
+ * nothing: every npm dep is checked against the source of truth.
+ *
+ * `packumentToFindings` is the pure extractor (unit-tested without network);
+ * `checkNpmRegistryDeps` is the cached, concurrent driver.
+ */
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+const pLimit = require("p-limit");
+const { semverCompare, webjarToNpm } = require("./collect");
+
+const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
+const CACHE_PATH = path.join(CACHE_DIR, "npm-registry-cache.json");
+const CACHE_MAX_AGE_MS = 24 * 3600 * 1000; // 1 day, aligned with Maven Central
+const REGISTRY = "https://registry.npmjs.org";
+
+function loadCache() {
+	try { return JSON.parse(fs.readFileSync(CACHE_PATH, "utf8")); }
+	catch { return { meta: { fetchedAt: 0 }, entries: {} }; }
+}
+
+function saveCache(data) {
+	try {
+		fs.mkdirSync(CACHE_DIR, { recursive: true });
+		fs.writeFileSync(CACHE_PATH, JSON.stringify(data));
+	} catch { /* ignore */ }
+}
+
+/** Pull a recommended replacement out of a free-form deprecation message. */
+function replacementFromMessage(msg) {
+	if (!msg) return null;
+	const url = msg.match(/https?:\/\/\S+/);
+	if (url) return url[0].replace(/[).,]+$/, "");
+	return "see deprecation notice";
+}
+
+/**
+ * Extract { deprecated, outdated } findings for one dep from its packument.
+ * Pure — no network, no cache. Either field is null when not applicable.
+ */
+function packumentToFindings(packument, dep) {
+	const out = { deprecated: null, outdated: null };
+	if (!packument || typeof packument !== "object") return out;
+
+	const versionEntry = packument.versions?.[dep.version];
+	const depMsg = versionEntry && typeof versionEntry.deprecated === "string"
+		? versionEntry.deprecated.trim()
+		: "";
+	if (depMsg) {
+		out.deprecated = {
+			dep,
+			severity: "MEDIUM",
+			replacement: replacementFromMessage(depMsg),
+			reason: depMsg,
+			source: "npm",
+		};
+	}
+
+	const latest = packument["dist-tags"]?.latest;
+	if (latest && dep.version) {
+		let behind = false;
+		try { behind = semverCompare(dep.version, latest) < 0; }
+		catch { behind = false; }
+		if (behind) {
+			const t = packument.time?.[latest];
+			out.outdated = {
+				dep,
+				latest,
+				releaseDate: typeof t === "string" ? t.slice(0, 10) : null,
+			};
+		}
+	}
+	return out;
+}
+
+/** registry.npmjs.org path-encodes a scoped name's slash. */
+function packumentUrl(name) {
+	return name.startsWith("@")
+		? `${REGISTRY}/${name.replace("/", "%2F")}`
+		: `${REGISTRY}/${encodeURIComponent(name)}`;
+}
+
+async function fetchPackument(name, opts = {}) {
+	if (opts.offline) return null;
+	const timeoutMs = opts.timeoutMs || 15000;
+	try {
+		// Per-request timeout: a single stalled connection must never hang the
+		// whole run (one slow package would otherwise occupy a concurrency slot
+		// forever and starve the pool).
+		const res = await fetch(packumentUrl(name), {
+			headers: { "User-Agent": "fad-checker-npm-registry", Accept: "application/json" },
+			signal: AbortSignal.timeout(timeoutMs),
+		});
+		if (!res.ok) return { error: `HTTP ${res.status}` };
+		return await res.json();
+	} catch (err) {
+		return { error: err.name === "TimeoutError" ? `timeout after ${timeoutMs}ms` : err.message };
+	}
+}
+
+/**
+ * Check every npm dep against the registry.
+ *
+ * Returns { deprecated: [obsolete-shaped], outdated: [outdated-shaped] }.
+ * Deprecation always runs (online); outdated is only collected when allLibs
+ * is set, mirroring the Maven Central outdated gate (--no-all-libs).
+ *
+ * opts: { verbose, offline, allLibs, concurrency = 8 }
+ */
+async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
+	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
+	// Targets = npm deps (queried by their own name) + WebJars (queried by their
+	// derived npm-equivalent name; version matches upstream). The original dep
+	// is kept for display/results so the report shows e.g. org.webjars:angularjs.
+	const targets = [];
+	for (const d of resolvedDeps.values()) {
+		if (!d.version) continue;
+		if (d.ecosystem === "npm") { targets.push({ dep: d, npmName: d.artifactId, version: d.version }); continue; }
+		const wj = webjarToNpm(d);
+		if (wj?.name) targets.push({ dep: d, npmName: wj.name, version: d.version });
+	}
+	const result = { deprecated: [], outdated: [] };
+	if (!targets.length) return result;
+
+	const cache = loadCache();
+	const fresh = cache.meta?.fetchedAt && (Date.now() - cache.meta.fetchedAt) < CACHE_MAX_AGE_MS;
+	if (!fresh && !offline) cache.entries = {};
+
+	const cacheKey = t => `${t.npmName}@${t.version}`;
+	const liveCount = offline ? 0 : targets.filter(t => !cache.entries[cacheKey(t)]).length;
+	if (liveCount && !offline) {
+		console.log(`📦 npm registry: checking ${targets.length} packages for deprecation${allLibs ? " + outdated" : ""} (${liveCount} live, ${targets.length - liveCount} cached)…`);
+	}
+
+	// Incremental progress — fetching ~hundreds/thousands of packuments at
+	// concurrency N would otherwise be total silence for a minute or more.
+	let processed = 0;
+	const startedAt = Date.now();
+	const printProgress = (final = false) => {
+		if (!liveCount) return;
+		const elapsed = Math.round((Date.now() - startedAt) / 1000);
+		const pct = Math.round((processed / targets.length) * 100);
+		const line = `   npm registry: ${processed}/${targets.length} (${pct}%) — ${elapsed}s`;
+		if (process.stdout.isTTY) process.stdout.write(`\r${line}${final ? "\n" : "          "}`);
+		else if (final) console.log(line);
+	};
+
+	const limit = pLimit(concurrency);
+	await Promise.all(targets.map(t => limit(async () => {
+		const { dep, npmName, version } = t;
+		const key = cacheKey(t);
+		let extracted = cache.entries[key];
+		if (!extracted) {
+			const packument = await fetchPackument(npmName, { offline });
+			if (packument && !packument.error) {
+				const f = packumentToFindings(packument, { version });
+				extracted = {
+					deprecated: f.deprecated ? { reason: f.deprecated.reason, replacement: f.deprecated.replacement } : null,
+					latest: f.outdated ? f.outdated.latest : null,
+					latestDate: f.outdated ? f.outdated.releaseDate : null,
+				};
+				cache.entries[key] = extracted;
+			} else {
+				extracted = { deprecated: null, latest: null, latestDate: null, error: packument?.error || "no data" };
+				if (!offline) cache.entries[key] = extracted;
+			}
+		}
+		processed++;
+		if (processed % 25 === 0 || processed === targets.length) printProgress();
+		if (extracted.deprecated) {
+			result.deprecated.push({
+				dep,
+				severity: "MEDIUM",
+				replacement: extracted.deprecated.replacement,
+				reason: extracted.deprecated.reason,
+				source: "npm",
+			});
+			if (verbose) process.stdout.write(`  deprecated: ${npmName}@${version}\n`);
+		}
+		if (allLibs && extracted.latest) {
+			result.outdated.push({ dep, latest: extracted.latest, releaseDate: extracted.latestDate || null });
+			if (verbose) process.stdout.write(`  outdated: ${npmName} ${version} → ${extracted.latest}\n`);
+		}
+	})));
+	if (liveCount) printProgress(true);
+
+	cache.meta = { fetchedAt: Date.now() };
+	saveCache(cache);
+
+	result.deprecated.sort((a, b) => a.dep.artifactId.localeCompare(b.dep.artifactId));
+	result.outdated.sort((a, b) => a.dep.artifactId.localeCompare(b.dep.artifactId));
+	if (liveCount && !offline) console.log(`   npm registry: ${result.deprecated.length} deprecated, ${result.outdated.length} outdated`);
+	return result;
+}
+
+module.exports = { packumentToFindings, checkNpmRegistryDeps, replacementFromMessage };

package/lib/outdated.js

@@ -9,6 +9,7 @@ const fs = require("fs");
 const path = require("path");
 const os = require("os");
 const { compareMavenVersions } = require("./maven-version");
+const { webjarToNpm } = require("./npm/collect");
 
 const KNOWN_OBSOLETE = require("../data/known-obsolete.json");
 const EOL_MAPPING = require("../data/eol-mapping.json");
@@ -39,6 +40,23 @@ function isEolCacheFresh(maxAge = EOL_CACHE_MAX_AGE_MS) {
 // -------- EOL via endoflife.date --------
 
 function findEolProduct(dep) {
+	// npm packages — and WebJars, which are client-side JS shipped as Maven
+	// artifacts — resolve by JS library name, not Maven coordinate. npm deps
+	// use their name directly; WebJars are reduced to their npm-equivalent name
+	// first (org.webjars:angularjs → "angularjs", org.webjars.npm:angular__core
+	// → "@angular/core"). The npm package literally named "angular" is AngularJS
+	// 1.x; modern Angular is the @angular/* scope — hence the name vs. scope maps.
+	const npmName = dep.ecosystem === "npm" ? (dep.artifactId || "") : webjarToNpm(dep)?.name;
+	if (npmName != null) {
+		const byName = EOL_MAPPING.by_npm_name?.[npmName];
+		if (byName) return byName;
+		const scopes = Object.keys(EOL_MAPPING.by_npm_scope || {})
+			.sort((a, b) => b.length - a.length);
+		for (const s of scopes) {
+			if (npmName.startsWith(s)) return EOL_MAPPING.by_npm_scope[s];
+		}
+		return null;
+	}
 	const key = `${dep.groupId}:${dep.artifactId}`;
 	const direct = EOL_MAPPING.by_group_artifact?.[key];
 	if (direct) return direct;
@@ -104,7 +122,6 @@ async function checkEolDeps(resolvedDeps, opts = {}) {
 	const seen = new Set();
 
 	for (const dep of resolvedDeps.values()) {
-		if (dep.ecosystem === "npm") continue; // EOL mapping is Maven-only for now
 		const product = findEolProduct(dep);
 		if (!product) continue;
 		const dedupeKey = `${dep.groupId}:${dep.artifactId}|${product.product}`;

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "fad-checker",
-  "version": "1.0.4",
-  "description": "Fucking Autonomous Dependency Checker — multi-ecosystem CVE / EOL / outdated / vendored-JS scanner for Maven, npm and Yarn monorepos. Self-contained HTML + Word report.",
+  "version": "1.0.5",
+  "description": "Fucking Autonomous Dependency Checker — Scans ALL pom/bom, npm/Yarn stuff and vendored JavaScript in a source tree, deal with private deps, multi modules & produces 1 HTML/DOC report with CVE, EOL, obsolete, outdated deps & fix recos",
   "license": "MIT",
+  "repository": "https://github.com/n8tz/fad-checker",
   "author": "pp9Ping <pp9Ping@gmail.com>",
   "maintainers": [
     "pp9Ping <pp9Ping@gmail.com>"

package/test/npm-registry.test.js

@@ -0,0 +1,64 @@
+const { test } = require("node:test");
+const assert = require("node:assert/strict");
+const { packumentToFindings } = require("../lib/npm/registry");
+
+const dep = (name, version) => ({ ecosystem: "npm", groupId: "", artifactId: name, version });
+
+test("packumentToFindings flags a deprecated resolved version", () => {
+	const packument = {
+		name: "request",
+		"dist-tags": { latest: "2.88.2" },
+		versions: {
+			"2.88.2": { deprecated: "request has been deprecated, see https://github.com/request/request/issues/3142" },
+		},
+		time: { "2.88.2": "2020-02-11T00:00:00.000Z" },
+	};
+	const { deprecated, outdated } = packumentToFindings(packument, dep("request", "2.88.2"));
+	assert.ok(deprecated, "should return a deprecated finding");
+	assert.match(deprecated.reason, /has been deprecated/);
+	assert.equal(deprecated.source, "npm");
+	assert.equal(deprecated.dep.artifactId, "request");
+	// Latest === current, so not outdated.
+	assert.equal(outdated, null);
+});
+
+test("packumentToFindings extracts a replacement URL from the deprecation message", () => {
+	const packument = {
+		"dist-tags": { latest: "1.0.0" },
+		versions: { "1.0.0": { deprecated: "use the foo package instead, see https://example.com/why" } },
+	};
+	const { deprecated } = packumentToFindings(packument, dep("bar", "1.0.0"));
+	assert.equal(deprecated.replacement, "https://example.com/why");
+});
+
+test("packumentToFindings reports outdated when latest is newer", () => {
+	const packument = {
+		"dist-tags": { latest: "3.7.1" },
+		versions: { "3.6.0": {} },
+		time: { "3.7.1": "2023-08-28T00:00:00.000Z" },
+	};
+	const { deprecated, outdated } = packumentToFindings(packument, dep("jquery", "3.6.0"));
+	assert.equal(deprecated, null, "not deprecated");
+	assert.ok(outdated, "should be outdated");
+	assert.equal(outdated.latest, "3.7.1");
+	assert.equal(outdated.releaseDate, "2023-08-28");
+});
+
+test("packumentToFindings returns nothing for an up-to-date, non-deprecated dep", () => {
+	const packument = {
+		"dist-tags": { latest: "4.18.2" },
+		versions: { "4.18.2": {} },
+	};
+	const { deprecated, outdated } = packumentToFindings(packument, dep("express", "4.18.2"));
+	assert.equal(deprecated, null);
+	assert.equal(outdated, null);
+});
+
+test("packumentToFindings tolerates a missing version entry", () => {
+	// Resolved version not present in the registry (e.g. unpublished) — must not throw.
+	const packument = { "dist-tags": { latest: "2.0.0" }, versions: { "2.0.0": {} } };
+	const { deprecated, outdated } = packumentToFindings(packument, dep("ghost", "1.5.0"));
+	assert.equal(deprecated, null);
+	assert.ok(outdated, "1.5.0 < 2.0.0 so still outdated");
+	assert.equal(outdated.latest, "2.0.0");
+});

package/test/outdated.test.js

@@ -54,3 +54,48 @@ test("findEolProduct picks longest prefix match", () => {
 	assert.equal(sec.product, "spring-framework");
 	assert.equal(sec.label, "Spring Security");
 });
+
+test("findEolProduct maps the npm 'angular' package to AngularJS 1.x", () => {
+	// The literal npm package named "angular" IS AngularJS (1.x), EOL since 2022.
+	const a = findEolProduct({ ecosystem: "npm", groupId: "", artifactId: "angular" });
+	assert.equal(a.product, "angularjs");
+	assert.equal(a.label, "AngularJS");
+});
+
+test("findEolProduct maps @angular/* scoped packages to modern Angular", () => {
+	const core = findEolProduct({ ecosystem: "npm", groupId: "", artifactId: "@angular/core" });
+	assert.equal(core.product, "angular");
+	const router = findEolProduct({ ecosystem: "npm", groupId: "", artifactId: "@angular/router" });
+	assert.equal(router.product, "angular");
+});
+
+test("findEolProduct maps react / react-dom / jquery / vue / bootstrap", () => {
+	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "react" }).product, "react");
+	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "react-dom" }).product, "react");
+	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "jquery" }).product, "jquery");
+	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "vue" }).product, "vue");
+	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "bootstrap" }).product, "bootstrap");
+});
+
+test("findEolProduct returns null for an unmapped npm package", () => {
+	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "left-pad" }), null);
+	// A Maven groupId must never leak into the npm lookup.
+	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "org.springframework" }), null);
+});
+
+test("findEolProduct maps WebJars (client-side JS shipped as Maven artifacts)", () => {
+	// org.webjars:angularjs:1.8.3 — AngularJS 1.x, EOL since 2021.
+	const ajs = findEolProduct({ groupId: "org.webjars", artifactId: "angularjs", version: "1.8.3" });
+	assert.ok(ajs, "org.webjars:angularjs must map");
+	assert.equal(ajs.product, "angularjs");
+
+	assert.equal(findEolProduct({ groupId: "org.webjars", artifactId: "jquery" }).product, "jquery");
+	assert.equal(findEolProduct({ groupId: "org.webjars", artifactId: "bootstrap" }).product, "bootstrap");
+	// org.webjars.npm mirrors npm names; scope slash is encoded as "__".
+	assert.equal(findEolProduct({ groupId: "org.webjars.npm", artifactId: "vue" }).product, "vue");
+	assert.equal(findEolProduct({ groupId: "org.webjars.npm", artifactId: "angular__core" }).product, "angular");
+});
+
+test("findEolProduct returns null for an unmapped WebJar artifact", () => {
+	assert.equal(findEolProduct({ groupId: "org.webjars", artifactId: "datatables" }), null);
+});

package/test/webjar.test.js

@@ -0,0 +1,33 @@
+const { test } = require("node:test");
+const assert = require("node:assert/strict");
+const { webjarToNpm } = require("../lib/npm/collect");
+
+test("webjarToNpm derives the npm name from org.webjars.npm (deterministic mirror)", () => {
+	assert.deepEqual(
+		webjarToNpm({ groupId: "org.webjars.npm", artifactId: "react", version: "18.2.0" }),
+		{ name: "react", version: "18.2.0" },
+	);
+	// Scoped packages encode "@scope/name" as "scope__name".
+	assert.deepEqual(
+		webjarToNpm({ groupId: "org.webjars.npm", artifactId: "angular__core", version: "17.2.3" }),
+		{ name: "@angular/core", version: "17.2.3" },
+	);
+});
+
+test("webjarToNpm passes classic org.webjars artifactIds through as-is", () => {
+	// Classic WebJars are hand-curated; the artifactId is the JS lib name.
+	assert.deepEqual(
+		webjarToNpm({ groupId: "org.webjars", artifactId: "angularjs", version: "1.8.3" }),
+		{ name: "angularjs", version: "1.8.3" },
+	);
+	assert.equal(webjarToNpm({ groupId: "org.webjars", artifactId: "jquery", version: "3.7.1" }).name, "jquery");
+});
+
+test("webjarToNpm handles bower webjars too", () => {
+	assert.equal(webjarToNpm({ groupId: "org.webjars.bowergithub.foo", artifactId: "bar", version: "1.0.0" }).name, "bar");
+});
+
+test("webjarToNpm returns null for non-webjar coordinates", () => {
+	assert.equal(webjarToNpm({ groupId: "org.springframework", artifactId: "spring-core", version: "6.0.0" }), null);
+	assert.equal(webjarToNpm({ ecosystem: "npm", groupId: "", artifactId: "react", version: "18.0.0" }), null);
+});