fad-checker 1.0.4 → 1.0.6

package/CLAUDE.md

@@ -15,7 +15,7 @@ Code-level orientation for contributors and Claude Code sessions on this repo.
    - retire.js (vendored JS signatures),
    - optionally Snyk (`--snyk`).
 4. Cross-checks every match's NVD CPE configurations against the dep version (`lib/cpe.js`) to filter false positives.
-5. Reports EOL frameworks (endoflife.date), obsolete libs (curated), outdated libs (Maven Central).
+5. Reports EOL frameworks (endoflife.date — Maven & npm), obsolete libs (curated Maven + npm-registry per-version `deprecated` field — authoritative, skips nothing), outdated libs (Maven Central + npm registry `dist-tags.latest`). **WebJars** (`org.webjars*`) are reduced to their npm coordinate by `webjarToNpm()` and run through the npm EOL/deprecation/outdated paths — so e.g. `org.webjars:angularjs:1.8.3` is flagged EOL.
 6. Produces a self-contained HTML report + Word-compatible `.doc`, organised by ecosystem and by defining manifest, with per-tool fix recipes and an executive summary.
 
 No build tool (`mvn`, `npm install`, `yarn`) is required on PATH — `pom.xml` / `package-lock.json` / `yarn.lock` are parsed directly.
@@ -67,6 +67,7 @@ lib/retire.js                retire.js (vendored-JS scanner) wrapper + cache + n
 lib/scan-completeness.js     Warnings for deps fad-checker couldn't fully resolve.
 lib/npm/parse.js             package.json, package-lock.json (v1/2/3), yarn.lock v1 parsers.
 lib/npm/collect.js           Merge across JS manifests → unified resolvedDeps Map.
+lib/npm/registry.js          npm registry packument query → per-version deprecation + dist-tags.latest (npm EOL feeds via lib/outdated.js).
 lib/cache-archive.js         tar.gz / zip export & import of ~/.fad-checker/.
 lib/config.js                Persistent user config in ~/.fad-checker/config.json (mode 0600).
 data/                        known-obsolete.json, eol-mapping.json, cpe-coord-map.json, known-public-namespaces.json
@@ -84,6 +85,7 @@ For the deep dive — pipeline stages, the resolved-deps Map shape, report struc
 - **No `process.exit(1)` mid-pipeline**: a parse/rewrite failure for one POM logs and continues so the summary still prints.
 - **HTML report is self-contained**: inline CSS, no external assets. The `.doc` variant is the same HTML with Office XML namespace meta tags — Word opens it natively.
 - **Map keys are ecosystem-namespaced**: Maven uses `g:a`, npm uses `npm:name`. They never collide so they share one resolved-deps Map.
+- **Every distinct version is scanned, not just the highest**: when profiles/modules pin the same `g:a` to different versions, the resolved-dep entry keeps `version` = highest (representative for display/EOL/outdated) but `versions` = all distinct concrete versions. CVE matching (`matchOne`) and OSV (`queryOsvForDeps`) iterate `versions` so a vuln affecting only a lower-versioned profile variant isn't missed. Match dedup keys are `g:a:version|cve.id` (version included) to preserve per-version findings.
 - **Lockfile-only npm**: `package.json` without sibling `package-lock.json`/`yarn.lock` is intentionally skipped (its ranges aren't queryable) and reported in chapter 0.
 - **Source identifiers**: every match carries `source: "fad" | "osv" | "nvd" | "snyk" | "retire"` (or a `+`-joined combination).
 
@@ -106,7 +108,7 @@ Test fixtures live in `test/fixtures/`:
 - CVE bundle from CVEProject is ~500 MB unpacked. Shells out to `curl + unzip` (fallback to `fetch()` + `unzip` / `Expand-Archive`). Extracted JSON deleted after index build. Ships as `cves.zip.zip` (nested zip) — `extractZip()` recurses up to 3 levels.
 - `endoflife.date` API responses cached 7 days; Maven Central version lookups cached 24 hours. Cache lives in `~/.fad-checker/`.
 - **Persistent config**: `~/.fad-checker/config.json` (mode 0600). Set NVD key via `fad-checker --set-nvd-key <KEY>` (free, instant from <https://nvd.nist.gov/developers/request-an-api-key> — bumps rate limit from 5/30s to 50/30s).
-- **`--offline` umbrella flag**: skips every network call (CVE/OSV/NVD/Maven Central/endoflife/retire). Falls back to whatever is already cached. Per-source variants (`--cve-offline`, `--no-osv`, `--no-nvd`, `--no-retire`, `--no-transitive`) still work independently.
+- **`--offline` umbrella flag**: skips every network call (CVE/OSV/NVD/Maven Central/endoflife/npm-registry/retire). Falls back to whatever is already cached. Per-source variants (`--cve-offline`, `--no-osv`, `--no-nvd`, `--no-retire`, `--no-transitive`, `--no-js`) still work independently. npm registry deprecation always runs when online; npm (and Maven) outdated is gated by `--no-all-libs`.
 - `snyk` is not a hard dep — shells out via `execFile`. `snyk` exits 1 on findings; the JSON is still on stdout.
 - The cleaned POM is the union of every profile's deps. Counts will be larger than the source POM. Intentional — don't "fix" that.
 - Unresolved `${…}` Maven variables stay verbatim in the rewritten POM. `lib/cve-match.js` resolves them lazily via `resolveDepVersion()` when scanning. Deps that *still* can't be resolved (external BOM not in source tree) surface in chapter 0 as `unresolved-versions` warnings.
@@ -122,5 +124,6 @@ Test fixtures live in `test/fixtures/`:
 | NVD CVE record | `~/.fad-checker/nvd-cache/<cveId>.json` | 7 d |
 | endoflife.date cycles | `~/.fad-checker/eol-cache.json` | 7 d |
 | Maven Central latest | `~/.fad-checker/version-cache.json` | 24 h |
+| npm registry (deprecation + latest) | `~/.fad-checker/npm-registry-cache.json` | 24 h |
 | Transitive POM | `~/.fad-checker/poms-cache/<g>__<a>__<v>.pom` | ∞ (immutable on Maven Central) |
 | retire.js findings | `~/.fad-checker/retire-cache/<md5(src)>.json` | 24 h |

package/data/eol-mapping.json

@@ -30,5 +30,17 @@
     "org.springframework": { "product": "spring-framework", "label": "Spring Framework" },
     "org.hibernate": { "product": "hibernate", "label": "Hibernate ORM" },
     "io.netty": { "product": "netty", "label": "Netty" }
+  },
+  "by_npm_name": {
+    "angular": { "product": "angularjs", "label": "AngularJS" },
+    "angularjs": { "product": "angularjs", "label": "AngularJS" },
+    "vue": { "product": "vue", "label": "Vue" },
+    "react": { "product": "react", "label": "React" },
+    "react-dom": { "product": "react", "label": "React" },
+    "jquery": { "product": "jquery", "label": "jQuery" },
+    "bootstrap": { "product": "bootstrap", "label": "Bootstrap" }
+  },
+  "by_npm_scope": {
+    "@angular/": { "product": "angular", "label": "Angular" }
   }
 }

package/docs/ARCHITECTURE.md

@@ -21,6 +21,7 @@ lib/retire.js                retire.js (vendored-JS scanner) wrapper + cache + n
 lib/scan-completeness.js     Warnings for deps we couldn't fully resolve.
 lib/npm/parse.js             package.json, package-lock.json (v1/2/3), yarn.lock v1 parsers.
 lib/npm/collect.js           Merge across JS manifests → unified resolvedDeps Map.
+lib/npm/registry.js          npm registry packument query → per-version deprecation + dist-tags.latest.
 lib/cache-archive.js         tar.gz / zip export & import of ~/.fad-checker/.
 lib/config.js                Persistent user config in ~/.fad-checker/config.json (mode 0600).
 data/                        Curated JSON: known-obsolete, eol-mapping, cpe-coord-map, known-public-namespaces.
@@ -77,10 +78,11 @@ The Maven keyspace and npm keyspace never collide — `:lodash` (Maven groupId-l
    - Confirms the dep version actually falls in the vulnerable range (else `cpeFiltered: true` — likely false positive).
    - Upgrades match `confidence` from `possible` → `probable` → `exact` when a curated `cpe-coord-map.json` entry confirms vendor:product → dep coord.
 8. **retire.js** (default on) — shells out to `retire --outputformat json --jspath <src>`. Output normalised to fad-checker match shape, with the vendored file path attached so the report can show where the offending `.js` lives. Cache: `~/.fad-checker/retire-cache/<md5(src)>.json`, 24h TTL.
-9. **EOL / Obsolete / Outdated** — `lib/outdated.js`:
-   - **EOL**: matches dep coord against `data/eol-mapping.json`, fetches the cycle list from endoflife.date (cached 7d), flags cycles past their EOL date.
-   - **Obsolete**: lookup in `data/known-obsolete.json` (curated: log4j 1.x, jackson-mapper-asl, joda-time, commons-httpclient 3.x, …).
-   - **Outdated**: Maven Central Solr query for the latest version. Cache 24h. Concurrency 8.
+9. **EOL / Obsolete / Outdated** — `lib/outdated.js` (Maven) + `lib/npm/registry.js` (npm):
+   - **WebJars** (`org.webjars*` — client-side JS shipped as Maven artifacts) are reduced to their npm-equivalent coordinate by `webjarToNpm()` (`lib/npm/collect.js`): `org.webjars.npm` is a deterministic npm mirror (`angular__core` → `@angular/core`); classic `org.webjars`/bower names pass through. They then flow through the **same npm paths** below — no WebJar-specific data.
+   - **EOL**: matches dep coord against `data/eol-mapping.json`, fetches the cycle list from endoflife.date (cached 7d), flags cycles past their EOL date. npm packages and WebJars resolve by JS library name via `by_npm_name` / `by_npm_scope` (e.g. npm `angular`/webjar `angularjs` → AngularJS 1.x, `@angular/*` → Angular, `react`/`jquery`/`vue`/`bootstrap`).
+   - **Obsolete**: Maven via curated `data/known-obsolete.json` (log4j 1.x, jackson-mapper-asl, joda-time, commons-httpclient 3.x, …); npm **and WebJars** via the registry's per-version `deprecated` field (authoritative maintainer data — every dep is checked, nothing curated, nothing skipped).
+   - **Outdated**: Maven Central Solr query; npm registry `dist-tags.latest` (npm deps and WebJars). Both gated by `--no-all-libs`. Cache 24h. Concurrency 8.
 10. **Snyk** (optional, `--snyk`) — runs `snyk test --all-projects --json` against the cleaned target dir. Normalised + merged. Findings in both sources tagged `source: "both"`.
 11. **Render** — `writeReports()` produces `cve-report.html` (self-contained, inline CSS, no external assets) and `cve-report.doc` (same HTML with Office XML namespace meta tags so Word opens it natively). Default output dir: `./fad-checker-report/`.
 
@@ -129,9 +131,9 @@ The Maven keyspace and npm keyspace never collide — `:lodash` (Maven groupId-l
 
 - The CVE bundle from CVEProject is ~500 MB unpacked. We shell out to `curl + unzip` (Node built-in fallback to `fetch()` + system `unzip` / PowerShell `Expand-Archive`). The extracted JSON is deleted after the index is built.
 - The bundle ships as `cves.zip.zip` (a zip whose sole content is another zip). `extractZip()` recurses up to 3 levels.
-- `endoflife.date` API responses are cached locally for 7 days; Maven Central version lookups for 24 hours.
+- `endoflife.date` API responses are cached locally for 7 days; Maven Central and npm registry version lookups for 24 hours.
 - **Persistent config**: `~/.fad-checker/config.json` (mode 0600) stores per-user state, currently the NVD API key. Set via `fad-checker --set-nvd-key <KEY>`.
-- **`--offline` umbrella flag**: skips every network call (CVE index download, OSV queries, NVD enrichment, endoflife.date lookups, Maven Central version queries, transitive POM fetches, retire.js scans). Falls back to whatever is already cached. Per-source variants (`--cve-offline`, `--no-osv`, `--no-nvd`, `--no-retire`) still work independently.
+- **`--offline` umbrella flag**: skips every network call (CVE index download, OSV queries, NVD enrichment, endoflife.date lookups, Maven Central version queries, npm registry queries, transitive POM fetches, retire.js scans). Falls back to whatever is already cached. Per-source variants (`--cve-offline`, `--no-osv`, `--no-nvd`, `--no-retire`, `--no-js`) still work independently.
 - `snyk` is not a dependency — we shell out via `execFile`. `snyk` exits 1 when it finds vulnerabilities, which is expected (the JSON is still on stdout).
 - The cleaned POM is the union of every profile's deps. Counts will therefore be larger than the source POM. This is intentional — verify your reasoning before "reducing" them.
 - Unresolved `${…}` Maven variables are kept verbatim in the rewritten POM. `lib/cve-match.js` resolves them lazily via `resolveDepVersion()` when collecting deps for the scan. Deps that *still* can't be resolved (external BOM) are surfaced in chapter 0 as `unresolved-versions` warnings.

package/fad-checker.js

@@ -464,6 +464,17 @@ async function runReportFlow(allPomMetadata, allPropsByPom, ecoFlags = {}) {
 		catch (err) { console.warn(chalk.yellow("⚠️  Outdated check skipped:"), err.message); }
 	}
 
+	// 4a. npm registry — deprecation (always, authoritative maintainer data) and
+	// outdated (gated by --all-libs like Maven Central). Covers npm deps and
+	// WebJars (Maven artifacts wrapping npm/bower libs), so it runs even in
+	// Maven-only mode. One fetch per package; no-ops when there are no targets.
+	try {
+		const { checkNpmRegistryDeps } = require("./lib/npm/registry");
+		const npmReg = await checkNpmRegistryDeps(resolved, { verbose, offline, allLibs: options.allLibs });
+		obsoleteResults = obsoleteResults.concat(npmReg.deprecated);
+		outdatedResults = outdatedResults.concat(npmReg.outdated);
+	} catch (err) { console.warn(chalk.yellow("⚠️  npm registry check skipped:"), err.message); }
+
 	// Cross-section dedup: drop entries from outdated that already appear in EOL/Obsolete
 	const eolKeys = new Set(eolResults.map(r => `${r.dep.groupId}:${r.dep.artifactId}`));
 	const obsKeys = new Set(obsoleteResults.map(r => `${r.dep.groupId}:${r.dep.artifactId}`));
@@ -574,16 +585,19 @@ async function runReportFlow(allPomMetadata, allPropsByPom, ecoFlags = {}) {
 		if (retireMatches.length > 10) console.log(`       ... and ${retireMatches.length - 10} more (see report)`);
 	}
 
+	// npm deps have no groupId; show them as "npm:name" rather than ":name".
+	const coordOf = d => d.ecosystem === "npm" ? `npm:${d.artifactId}` : `${d.groupId}:${d.artifactId}`;
+
 	console.log(chalk.bold.cyan("\n  2. End-of-Life Frameworks"));
-	for (const e of eolResults) console.log(`     ${e.product.padEnd(20)} ${e.dep.groupId}:${e.dep.artifactId}:${e.dep.version}  ${e.eol}`);
+	for (const e of eolResults) console.log(`     ${e.product.padEnd(20)} ${coordOf(e.dep)}:${e.dep.version}  ${e.eol}`);
 	if (!eolResults.length) console.log(chalk.gray("     (none)"));
 
 	console.log(chalk.bold.cyan("\n  3. Obsolete / Deprecated Libraries"));
-	for (const o of obsoleteResults) console.log(`     ${(o.severity || "info").padEnd(8)} ${o.dep.groupId}:${o.dep.artifactId}:${o.dep.version}  → ${o.replacement || "n/a"}`);
+	for (const o of obsoleteResults) console.log(`     ${(o.severity || "info").padEnd(8)} ${coordOf(o.dep)}:${o.dep.version}  → ${o.replacement || "n/a"}`);
 	if (!obsoleteResults.length) console.log(chalk.gray("     (none)"));
 
 	console.log(chalk.bold.cyan("\n  4. Outdated Libraries"));
-	for (const o of outdatedResults.slice(0, 20)) console.log(`     ${o.dep.groupId}:${o.dep.artifactId}  ${o.dep.version} → ${o.latest}`);
+	for (const o of outdatedResults.slice(0, 20)) console.log(`     ${coordOf(o.dep)}  ${o.dep.version} → ${o.latest}`);
 	if (outdatedResults.length > 20) console.log(`       ... and ${outdatedResults.length - 20} more`);
 	if (!outdatedResults.length && options.allLibs) console.log(chalk.gray("     (none)"));
 	if (!options.allLibs) console.log(chalk.gray("     (re-run with -a/--allLibs to query Maven Central)"));
@@ -634,7 +648,7 @@ async function runReportFlow(allPomMetadata, allPropsByPom, ecoFlags = {}) {
  */
 function mergeBySource(existing, additions) {
 	const byKey = new Map();
-	const k = m => `${m.dep.groupId}:${m.dep.artifactId}|${m.cve.id}`;
+	const k = m => `${m.dep.groupId}:${m.dep.artifactId}:${m.dep.version}|${m.cve.id}`;
 	for (const m of existing || []) byKey.set(k(m), { ...m, source: m.source || "fad" });
 	for (const m of additions || []) {
 		const key = k(m);

package/lib/cve-match.js

@@ -20,10 +20,13 @@ function resolveDepVersion(rawVersion, allProps) {
 
 /**
  * Walk allPomMetadata.byPath, collect every {groupId,artifactId,version,scope}
- * triple, dedupe by groupId:artifactId keeping the highest version seen,
- * also include external parent POMs as scope='parent'.
+ * triple, dedupe by groupId:artifactId. `version` is the highest seen
+ * (representative for display/EOL/outdated), while `versions` keeps EVERY
+ * distinct concrete version (e.g. two profiles pinning the same g:a) so the
+ * CVE/OSV scanners check each one, not just the highest. Also includes
+ * external parent POMs as scope='parent'.
  *
- * Returns Map<key, { groupId, artifactId, version, scope, pomPaths }>
+ * Returns Map<key, { groupId, artifactId, version, versions, scope, pomPaths }>
  */
 function collectResolvedDeps(allPomMetadata, allPropsByPom, opts = {}) {
 	const { ignoreTest, deps2Exclude } = opts;
@@ -43,14 +46,19 @@ function collectResolvedDeps(allPomMetadata, allPropsByPom, opts = {}) {
 			const key = `${g}:${a}`;
 			const existing = out.get(key);
 			const isDev = scope === "test" || scope === "provided";
+			// A concrete (resolved, non-property) version worth scanning on its own.
+			const concrete = v && !/\$\{/.test(v) ? v : null;
 			if (!existing) {
-				out.set(key, { groupId: g, artifactId: a, version: v || null, scope, pomPaths: [pomPath], ecosystem: "maven", ecosystemType: "maven", isDev });
+				out.set(key, { groupId: g, artifactId: a, version: v || null, versions: concrete ? [concrete] : [], scope, pomPaths: [pomPath], ecosystem: "maven", ecosystemType: "maven", isDev });
 			} else {
 				if (!existing.pomPaths.includes(pomPath)) existing.pomPaths.push(pomPath);
 				if (existing.scope === "test" && scope !== "test") existing.scope = scope;
 				if (v && (!existing.version || compareMavenVersions(v, existing.version) > 0)) {
 					existing.version = v;
 				}
+				// Track every distinct concrete version (e.g. different profiles
+				// pinning the same g:a) so each gets scanned, not just the highest.
+				if (concrete && !existing.versions.includes(concrete)) existing.versions.push(concrete);
 				// A dep is "dev" overall only if every occurrence is test/provided.
 				if (!isDev) existing.isDev = false;
 			}
@@ -77,6 +85,7 @@ function collectResolvedDeps(allPomMetadata, allPropsByPom, opts = {}) {
 		if (!out.has(key)) {
 			out.set(key, {
 				groupId: p.groupId, artifactId: p.artifactId, version: p.version || null,
+				versions: p.version && !/\$\{/.test(p.version) ? [p.version] : [],
 				scope: "parent", pomPaths: [pomPath], ecosystem: "maven", ecosystemType: "maven",
 			});
 		}
@@ -127,6 +136,7 @@ async function expandWithTransitives(resolvedDeps, opts = {}) {
 			groupId: t.groupId,
 			artifactId: t.artifactId,
 			version: t.version,
+			versions: t.version && !/\$\{/.test(t.version) ? [t.version] : [],
 			scope: "transitive",
 			pomPaths: [],
 			via: t.via,
@@ -151,12 +161,21 @@ async function expandWithTransitives(resolvedDeps, opts = {}) {
 function matchOne(dep, entries, confidence) {
 	const matches = [];
 	if (!entries) return matches;
+	// Scan every distinct version the dep resolves to (e.g. two profiles pinning
+	// the same g:a), not just the representative highest — otherwise a CVE that
+	// only affects a lower-versioned profile variant would be missed.
+	const versions = (dep.versions && dep.versions.length) ? dep.versions : [dep.version];
 	for (const e of entries) {
-		const affected = (e.ranges || []).some(r => {
-			if (!dep.version) return r.status === "affected"; // unknown version → assume affected
-			return isVersionAffected(dep.version, r);
-		});
-		if (affected) matches.push({ dep, cve: { ...e }, confidence });
+		for (const ver of versions) {
+			const affected = (e.ranges || []).some(r => {
+				if (!ver) return r.status === "affected"; // unknown version → assume affected
+				return isVersionAffected(ver, r);
+			});
+			if (affected) {
+				const vdep = ver === dep.version ? dep : { ...dep, version: ver };
+				matches.push({ dep: vdep, cve: { ...e }, confidence });
+			}
+		}
 	}
 	return matches;
 }
@@ -212,7 +231,7 @@ function matchDepsAgainstCves(resolvedDeps, cveIndex, opts = {}) {
 	const seen = new Set();
 	const deduped = [];
 	for (const m of all) {
-		const k = `${m.dep.groupId}:${m.dep.artifactId}|${m.cve.id}`;
+		const k = `${m.dep.groupId}:${m.dep.artifactId}:${m.dep.version}|${m.cve.id}`;
 		if (seen.has(k)) continue;
 		seen.add(k);
 		deduped.push(m);

package/lib/cve-report.js

@@ -132,6 +132,7 @@ code.path { font-family: ui-monospace, monospace; font-size: 0.9em; background:
 .exec-summary .exec-head { display: flex; align-items: center; gap: 12px; }
 .exec-summary .exec-level { font-size: 12px; font-weight: 700; letter-spacing: 1px; padding: 4px 12px; border-radius: 999px; }
 .exec-summary .exec-title { font-size: 18px; font-weight: 600; color: #111827; }
+.exec-summary .exec-copy-btn { margin-left: auto; }
 .exec-summary .exec-meta { font-size: 12px; color: #6b7280; }
 .exec-summary .exec-bullets { margin: 4px 0 0; padding-left: 22px; font-size: 13px; color: #374151; line-height: 1.6; }
 .exec-summary.exec-critical { border-color: #dc2626; }
@@ -522,7 +523,7 @@ function renderDetailPanel(m) {
 
 	// 7. Declared-in POMs
 	if (dep.pomPaths?.length) {
-		const items = dep.pomPaths.slice(0, 10).map(p => `<div>${esc(p)}</div>`).join("");
+		const items = dep.pomPaths.slice(0, 10).map(p => `<div>${esc(makeRelative(p, RENDER_CTX.srcRoot))}</div>`).join("");
 		sections.push(section("Declared in",
 			`<div class="via-list">${items}${dep.pomPaths.length > 10 ? `<div style="color:#9ca3af">+${dep.pomPaths.length - 10} more</div>` : ""}</div>`,
 			{ count: `${dep.pomPaths.length} POM${dep.pomPaths.length > 1 ? "s" : ""}`, open: false }));
@@ -1029,7 +1030,7 @@ function summaryCards(stats, eol, obs, out, extra = {}) {
 function mergeMatches(matches) {
 	const byKey = new Map();
 	for (const m of matches) {
-		const key = `${m.dep.groupId}:${m.dep.artifactId}|${m.cve.id}`;
+		const key = `${m.dep.groupId}:${m.dep.artifactId}:${m.dep.version}|${m.cve.id}`;
 		if (!byKey.has(key)) {
 			// Deep-ish copy so we can mutate dep.viaPaths
 			byKey.set(key, { ...m, dep: { ...m.dep, viaPaths: m.dep.viaPaths ? [...m.dep.viaPaths] : (m.dep.via ? [m.dep.via] : []) } });
@@ -1150,7 +1151,7 @@ function renderRetireTable(matches) {
 	const rows = sorted.map(m => `<tr>
 		<td>${badge((m.cve.severity || "MEDIUM").toUpperCase())}</td>
 		<td class="dep">${esc(m.dep.artifactId)}<br><span style="color:#6b7280">${esc(m.dep.version || "?")}</span></td>
-		<td class="dep"><code class="path">${esc(m.dep.vendoredFile || "")}</code></td>
+		<td class="dep"><code class="path">${esc(makeRelative(m.dep.vendoredFile || "", RENDER_CTX.srcRoot))}</code></td>
 		<td class="cve">${m.cve.id?.startsWith("CVE-") ? `<a href="https://nvd.nist.gov/vuln/detail/${esc(m.cve.id)}" target="_blank" rel="noopener">${esc(m.cve.id)}</a>` : esc(m.cve.id)}</td>
 		<td class="dep">${esc(m.cve.fixVersion || "—")}</td>
 		<td class="desc">${esc(shortDesc(m.cve.description))}</td>
@@ -1161,7 +1162,22 @@ function renderRetireTable(matches) {
 	</table>`;
 }
 
-function renderExecutiveSummary({ projectInfo, prodStats, devStats, retireStats, eolResults, obsoleteResults, outdatedResults, warnings, totalDeps, topCriticalMatches }) {
+/**
+ * One "vulnerable to" clause for a match, in the format requested for the
+ * Word-pasteable summary: prefer the primary CWE ("CWE-79 : Cross-site
+ * Scripting"), fall back to the CVE id when no weakness is recorded.
+ */
+function execWeakness(m) {
+	const cwes = Array.isArray(m.cve.cwes) ? m.cve.cwes : [];
+	const primary = cwes.find(c => cweName(c)) || cwes[0];
+	if (primary) {
+		const label = cweName(primary);
+		return label ? `${primary} : ${label}` : primary;
+	}
+	return m.cve.id || "an unspecified weakness";
+}
+
+function renderExecutiveSummary({ projectInfo, prodStats, devStats, retireStats, eolResults, obsoleteResults, outdatedResults, warnings, totalDeps, topCriticalMatches, interactive = false }) {
 	const eolN = eolResults?.length || 0;
 	const obsN = obsoleteResults?.length || 0;
 	const outN = outdatedResults?.length || 0;
@@ -1204,10 +1220,59 @@ function renderExecutiveSummary({ projectInfo, prodStats, devStats, retireStats,
 		}).join("")}</ul>
 	</div>` : "";
 
+	// ---- Word-pasteable copy payload (built only for the interactive HTML) ----
+	let copyUi = "";
+	if (interactive) {
+		const stripTags = s => s.replace(/<[^>]+>/g, "");
+		const plainBullets = bullets.map(stripTags);
+		const top = topCriticalMatches || [];
+		const topSentences = top.map(m => ({
+			lib: depDisplayName(m.dep),
+			ver: m.dep.version || "?",
+			weakness: execWeakness(m),
+			crit: (m.cve.severity || "HIGH").toUpperCase(),
+		}));
+
+		// Plain-text version (text/plain) — exact bullet format requested.
+		const plainLines = [];
+		plainLines.push(`EXECUTIVE SUMMARY — ${level}`);
+		plainLines.push(`${totalDeps} dependencies scanned`);
+		plainLines.push("");
+		if (plainBullets.length) for (const b of plainBullets) plainLines.push(`- ${b}`);
+		else plainLines.push("- No findings detected.");
+		if (topSentences.length) {
+			plainLines.push("");
+			plainLines.push(`Top ${topSentences.length} most critical:`);
+			for (const t of topSentences) {
+				plainLines.push(`- The library "${t.lib}" version "${t.ver}" is vulnerable to "${t.weakness}" ( ${t.crit} )`);
+			}
+		}
+		const plainText = plainLines.join("\n");
+
+		// Rich version (text/html) — inline styles so Word keeps the formatting.
+		const richBullets = plainBullets.length
+			? `<ul style="margin:4px 0 0; padding-left:22px;">${plainBullets.map(b => `<li style="margin:2px 0;">${esc(b)}</li>`).join("")}</ul>`
+			: `<p style="margin:4px 0;">No findings detected.</p>`;
+		const richTop = topSentences.length
+			? `<p style="font-weight:bold; margin:12px 0 4px;">Top ${topSentences.length} most critical:</p>
+			<ul style="margin:0; padding-left:22px;">${topSentences.map(t =>
+				`<li style="margin:3px 0;">The library "<b>${esc(t.lib)}</b>" version "<b>${esc(t.ver)}</b>" is vulnerable to "<b>${esc(t.weakness)}</b>" ( ${esc(t.crit)} )</li>`).join("")}</ul>`
+			: "";
+		const richHtml = `<div style="font-family:Calibri,Arial,sans-serif; font-size:11pt; color:#1f2937;">`
+			+ `<p style="font-size:14pt; font-weight:bold; margin:0 0 2px;">Executive Summary — ${esc(level)}</p>`
+			+ `<p style="margin:0 0 8px; color:#4b5563;">${esc(totalDeps)} dependencies scanned</p>`
+			+ richBullets + richTop + `</div>`;
+
+		copyUi = `<button class="btn-copy exec-copy-btn" type="button" title="Copy the executive summary — paste it into Word with formatting preserved">📋 Copy summary</button>`
+			+ `<template class="exec-copy-rich">${richHtml}</template>`
+			+ `<textarea class="exec-copy-plain" aria-hidden="true" tabindex="-1" style="position:absolute;left:-9999px;top:0;width:1px;height:1px;opacity:0;">${esc(plainText)}</textarea>`;
+	}
+
 	return `<div class="exec-summary exec-${esc(level.toLowerCase())}">
 		<div class="exec-head">
 			<span class="exec-level">${esc(level)}</span>
 			<span class="exec-title">Executive Summary</span>
+			${copyUi}
 		</div>
 		<div class="exec-meta">${esc(totalDeps)} dependencies scanned</div>
 		<ul class="exec-bullets">
@@ -1248,7 +1313,7 @@ function renderWarningItems(items, itemLimit) {
 		const id = it.id || "";
 		const paths = (it.manifestPaths || []).slice(0, 6);
 		const pathsHtml = paths.length
-			? `<div class="warn-defined">defined in: ${paths.map(p => `<code class="path">${esc(p)}</code>`).join(", ")}${it.manifestPaths.length > paths.length ? ` <span class="warn-defined-more">+${it.manifestPaths.length - paths.length} more</span>` : ""}</div>`
+			? `<div class="warn-defined">defined in: ${paths.map(p => `<code class="path">${esc(makeRelative(p, RENDER_CTX.srcRoot))}</code>`).join(", ")}${it.manifestPaths.length > paths.length ? ` <span class="warn-defined-more">+${it.manifestPaths.length - paths.length} more</span>` : ""}</div>`
 			: "";
 		return `<li><code>${esc(id)}</code>${pathsHtml}</li>`;
 	}).join("");
@@ -1298,6 +1363,7 @@ function buildBody({ cveMatches, devCveMatches, retireMatches, eolResults, obsol
 		eolResults, obsoleteResults, outdatedResults,
 		warnings, totalDeps: resolvedDeps?.size || 0,
 		topCriticalMatches: pickTopCriticalMatches(prodMatchesActive, retireMatches, 5),
+		interactive: wrapTables, // copy button + scripts only in the HTML output
 	});
 
 	// (C) Table of contents — rendered as a sticky nav. Only enumerates the
@@ -1488,31 +1554,32 @@ const COPY_SCRIPT = `
 			btn.classList.remove(cls);
 		}, 1500);
 	}
-	async function copyTable(table, btn){
-		var clone = inlineStylesForWord(table);
-		var html = wordWrapper(clone.outerHTML);
-		var tsv = tableToTsv(table);
+	// Write rich HTML (+ plain-text fallback) to the clipboard. Shared by the
+	// table buttons and the executive-summary button. richInner is the HTML
+	// fragment; we wrap it with the Office namespaces so Word keeps formatting.
+	async function writeClipboard(richInner, plain, btn){
+		var html = wordWrapper(richInner);
 		// Modern path: ClipboardItem with text/html + text/plain
 		try {
 			if (window.ClipboardItem && navigator.clipboard && navigator.clipboard.write) {
 				await navigator.clipboard.write([
 					new ClipboardItem({
-						'text/html':  new Blob([html], { type: 'text/html'  }),
-						'text/plain': new Blob([tsv],  { type: 'text/plain' })
+						'text/html':  new Blob([html],  { type: 'text/html'  }),
+						'text/plain': new Blob([plain], { type: 'text/plain' })
 					})
 				]);
 				flash(btn, 'flashing-ok', '✓ Copied!');
 				return;
 			}
 		} catch(e) { /* fall through to legacy path */ }
-		// Legacy path: select clone, execCommand('copy') — gets the HTML
+		// Legacy path: select a contenteditable clone, execCommand('copy')
 		try {
 			var temp = document.createElement('div');
 			temp.setAttribute('contenteditable', 'true');
 			temp.style.position = 'fixed';
 			temp.style.left = '-9999px';
 			temp.style.top = '0';
-			temp.innerHTML = clone.outerHTML;
+			temp.innerHTML = richInner;
 			document.body.appendChild(temp);
 			var range = document.createRange();
 			range.selectNodeContents(temp);
@@ -1527,7 +1594,14 @@ const COPY_SCRIPT = `
 			flash(btn, 'flashing-err', '✗ Copy failed');
 		}
 	}
+	function copyTable(table, btn){
+		var clone = inlineStylesForWord(table);
+		return writeClipboard(clone.outerHTML, tableToTsv(table), btn);
+	}
 	document.querySelectorAll('.btn-copy').forEach(function(btn){
+		// The executive-summary button is wired separately (it copies a prose
+		// summary, not a table).
+		if (btn.classList.contains('exec-copy-btn')) return;
 		btn.addEventListener('click', function(e){
 			e.stopPropagation();
 			var wrap = btn.closest('.table-wrap');
@@ -1535,6 +1609,15 @@ const COPY_SCRIPT = `
 			if (table) copyTable(table, btn);
 		});
 	});
+	var execBtn = document.querySelector('.exec-copy-btn');
+	if (execBtn) execBtn.addEventListener('click', function(e){
+		e.stopPropagation();
+		var tpl = document.querySelector('.exec-copy-rich');
+		var ta = document.querySelector('.exec-copy-plain');
+		var rich = tpl ? (tpl.innerHTML || '') : '';
+		var plain = ta ? (ta.value || '') : '';
+		writeClipboard(rich, plain, execBtn);
+	});
 })();
 </script>`;
 

package/lib/npm/collect.js

@@ -199,6 +199,30 @@ function safeParse(fn, file, verbose) {
 	}
 }
 
+/**
+ * WebJars are client-side JS libraries shipped as Maven artifacts. Derive the
+ * upstream npm coordinate from a WebJar dep so it can flow through the npm
+ * pipeline (registry deprecation/outdated + endoflife EOL) instead of being
+ * special-cased.
+ *
+ *   org.webjars.npm  — deterministic npm mirror. artifactId == npm name;
+ *                      a scoped "@scope/name" is encoded as "scope__name".
+ *   org.webjars      — hand-curated catalogue; artifactId is the JS lib name
+ *                      (mostly aligned with npm, e.g. jquery/bootstrap).
+ *   org.webjars.bower* — Bower mirrors; best-effort name match.
+ *
+ * Versions match the upstream package. Returns { name, version } or null for a
+ * non-WebJar coordinate.
+ */
+function webjarToNpm(dep) {
+	const g = dep.groupId || "";
+	if (g !== "org.webjars" && !g.startsWith("org.webjars.")) return null;
+	let name = dep.artifactId || "";
+	if (!name) return null;
+	if (name.includes("__")) name = "@" + name.replace(/__/g, "/");
+	return { name, version: dep.version || null };
+}
+
 function hasJsManifests(rootDir) {
 	try {
 		const stack = [rootDir];
@@ -221,4 +245,4 @@ function hasJsManifests(rootDir) {
 	return false;
 }
 
-module.exports = { collectNpmDeps, hasJsManifests };
+module.exports = { collectNpmDeps, hasJsManifests, semverCompare, webjarToNpm };

package/lib/npm/registry.js

@@ -0,0 +1,206 @@
+/**
+ * lib/npm/registry.js — npm registry queries for the npm half of the
+ * EOL/obsolete/outdated story.
+ *
+ * Two authoritative, online signals come from one packument fetch:
+ *   - deprecated: the maintainer's `deprecated` string on the *resolved*
+ *     version (the same data behind `npm WARN deprecated …`).
+ *   - outdated:   `dist-tags.latest` vs. the resolved version.
+ *
+ * The point of querying the registry rather than a curated list is to skip
+ * nothing: every npm dep is checked against the source of truth.
+ *
+ * `packumentToFindings` is the pure extractor (unit-tested without network);
+ * `checkNpmRegistryDeps` is the cached, concurrent driver.
+ */
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+const pLimit = require("p-limit");
+const { semverCompare, webjarToNpm } = require("./collect");
+
+const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
+const CACHE_PATH = path.join(CACHE_DIR, "npm-registry-cache.json");
+const CACHE_MAX_AGE_MS = 24 * 3600 * 1000; // 1 day, aligned with Maven Central
+const REGISTRY = "https://registry.npmjs.org";
+
+function loadCache() {
+	try { return JSON.parse(fs.readFileSync(CACHE_PATH, "utf8")); }
+	catch { return { meta: { fetchedAt: 0 }, entries: {} }; }
+}
+
+function saveCache(data) {
+	try {
+		fs.mkdirSync(CACHE_DIR, { recursive: true });
+		fs.writeFileSync(CACHE_PATH, JSON.stringify(data));
+	} catch { /* ignore */ }
+}
+
+/** Pull a recommended replacement out of a free-form deprecation message. */
+function replacementFromMessage(msg) {
+	if (!msg) return null;
+	const url = msg.match(/https?:\/\/\S+/);
+	if (url) return url[0].replace(/[).,]+$/, "");
+	return "see deprecation notice";
+}
+
+/**
+ * Extract { deprecated, outdated } findings for one dep from its packument.
+ * Pure — no network, no cache. Either field is null when not applicable.
+ */
+function packumentToFindings(packument, dep) {
+	const out = { deprecated: null, outdated: null };
+	if (!packument || typeof packument !== "object") return out;
+
+	const versionEntry = packument.versions?.[dep.version];
+	const depMsg = versionEntry && typeof versionEntry.deprecated === "string"
+		? versionEntry.deprecated.trim()
+		: "";
+	if (depMsg) {
+		out.deprecated = {
+			dep,
+			severity: "MEDIUM",
+			replacement: replacementFromMessage(depMsg),
+			reason: depMsg,
+			source: "npm",
+		};
+	}
+
+	const latest = packument["dist-tags"]?.latest;
+	if (latest && dep.version) {
+		let behind = false;
+		try { behind = semverCompare(dep.version, latest) < 0; }
+		catch { behind = false; }
+		if (behind) {
+			const t = packument.time?.[latest];
+			out.outdated = {
+				dep,
+				latest,
+				releaseDate: typeof t === "string" ? t.slice(0, 10) : null,
+			};
+		}
+	}
+	return out;
+}
+
+/** registry.npmjs.org path-encodes a scoped name's slash. */
+function packumentUrl(name) {
+	return name.startsWith("@")
+		? `${REGISTRY}/${name.replace("/", "%2F")}`
+		: `${REGISTRY}/${encodeURIComponent(name)}`;
+}
+
+async function fetchPackument(name, opts = {}) {
+	if (opts.offline) return null;
+	const timeoutMs = opts.timeoutMs || 15000;
+	try {
+		// Per-request timeout: a single stalled connection must never hang the
+		// whole run (one slow package would otherwise occupy a concurrency slot
+		// forever and starve the pool).
+		const res = await fetch(packumentUrl(name), {
+			headers: { "User-Agent": "fad-checker-npm-registry", Accept: "application/json" },
+			signal: AbortSignal.timeout(timeoutMs),
+		});
+		if (!res.ok) return { error: `HTTP ${res.status}` };
+		return await res.json();
+	} catch (err) {
+		return { error: err.name === "TimeoutError" ? `timeout after ${timeoutMs}ms` : err.message };
+	}
+}
+
+/**
+ * Check every npm dep against the registry.
+ *
+ * Returns { deprecated: [obsolete-shaped], outdated: [outdated-shaped] }.
+ * Deprecation always runs (online); outdated is only collected when allLibs
+ * is set, mirroring the Maven Central outdated gate (--no-all-libs).
+ *
+ * opts: { verbose, offline, allLibs, concurrency = 8 }
+ */
+async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
+	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
+	// Targets = npm deps (queried by their own name) + WebJars (queried by their
+	// derived npm-equivalent name; version matches upstream). The original dep
+	// is kept for display/results so the report shows e.g. org.webjars:angularjs.
+	const targets = [];
+	for (const d of resolvedDeps.values()) {
+		if (!d.version) continue;
+		if (d.ecosystem === "npm") { targets.push({ dep: d, npmName: d.artifactId, version: d.version }); continue; }
+		const wj = webjarToNpm(d);
+		if (wj?.name) targets.push({ dep: d, npmName: wj.name, version: d.version });
+	}
+	const result = { deprecated: [], outdated: [] };
+	if (!targets.length) return result;
+
+	const cache = loadCache();
+	const fresh = cache.meta?.fetchedAt && (Date.now() - cache.meta.fetchedAt) < CACHE_MAX_AGE_MS;
+	if (!fresh && !offline) cache.entries = {};
+
+	const cacheKey = t => `${t.npmName}@${t.version}`;
+	const liveCount = offline ? 0 : targets.filter(t => !cache.entries[cacheKey(t)]).length;
+	if (liveCount && !offline) {
+		console.log(`📦 npm registry: checking ${targets.length} packages for deprecation${allLibs ? " + outdated" : ""} (${liveCount} live, ${targets.length - liveCount} cached)…`);
+	}
+
+	// Incremental progress — fetching ~hundreds/thousands of packuments at
+	// concurrency N would otherwise be total silence for a minute or more.
+	let processed = 0;
+	const startedAt = Date.now();
+	const printProgress = (final = false) => {
+		if (!liveCount) return;
+		const elapsed = Math.round((Date.now() - startedAt) / 1000);
+		const pct = Math.round((processed / targets.length) * 100);
+		const line = `   npm registry: ${processed}/${targets.length} (${pct}%) — ${elapsed}s`;
+		if (process.stdout.isTTY) process.stdout.write(`\r${line}${final ? "\n" : "          "}`);
+		else if (final) console.log(line);
+	};
+
+	const limit = pLimit(concurrency);
+	await Promise.all(targets.map(t => limit(async () => {
+		const { dep, npmName, version } = t;
+		const key = cacheKey(t);
+		let extracted = cache.entries[key];
+		if (!extracted) {
+			const packument = await fetchPackument(npmName, { offline });
+			if (packument && !packument.error) {
+				const f = packumentToFindings(packument, { version });
+				extracted = {
+					deprecated: f.deprecated ? { reason: f.deprecated.reason, replacement: f.deprecated.replacement } : null,
+					latest: f.outdated ? f.outdated.latest : null,
+					latestDate: f.outdated ? f.outdated.releaseDate : null,
+				};
+				cache.entries[key] = extracted;
+			} else {
+				extracted = { deprecated: null, latest: null, latestDate: null, error: packument?.error || "no data" };
+				if (!offline) cache.entries[key] = extracted;
+			}
+		}
+		processed++;
+		if (processed % 25 === 0 || processed === targets.length) printProgress();
+		if (extracted.deprecated) {
+			result.deprecated.push({
+				dep,
+				severity: "MEDIUM",
+				replacement: extracted.deprecated.replacement,
+				reason: extracted.deprecated.reason,
+				source: "npm",
+			});
+			if (verbose) process.stdout.write(`  deprecated: ${npmName}@${version}\n`);
+		}
+		if (allLibs && extracted.latest) {
+			result.outdated.push({ dep, latest: extracted.latest, releaseDate: extracted.latestDate || null });
+			if (verbose) process.stdout.write(`  outdated: ${npmName} ${version} → ${extracted.latest}\n`);
+		}
+	})));
+	if (liveCount) printProgress(true);
+
+	cache.meta = { fetchedAt: Date.now() };
+	saveCache(cache);
+
+	result.deprecated.sort((a, b) => a.dep.artifactId.localeCompare(b.dep.artifactId));
+	result.outdated.sort((a, b) => a.dep.artifactId.localeCompare(b.dep.artifactId));
+	if (liveCount && !offline) console.log(`   npm registry: ${result.deprecated.length} deprecated, ${result.outdated.length} outdated`);
+	return result;
+}
+
+module.exports = { packumentToFindings, checkNpmRegistryDeps, replacementFromMessage };

package/lib/osv.js

@@ -295,20 +295,26 @@ function runMatches(deps, indexMap, detailById) {
 async function queryOsvForDeps(resolvedDeps, opts = {}) {
 	const deps = [];
 	for (const d of resolvedDeps.values()) {
-		if (!d.version || /\$\{|SNAPSHOT/i.test(d.version)) continue;
 		if (d.scope === "parent") continue; // parents don't have OSV entries typically
-		// npm version specifiers like "^1.0.0" can't be queried against OSV — need
-		// a concrete version. Lockfiles always provide one; package.json-only deps
-		// are skipped here.
-		if (d.ecosystem === "npm" && /^[\^~>=<*]|^(latest|next|workspace:|git\+|file:|link:)/.test(d.version)) continue;
-		deps.push({
-			groupId: d.groupId, artifactId: d.artifactId, version: d.version,
-			scope: d.scope, via: d.via, depth: d.depth, pomPaths: d.pomPaths,
-			manifestPaths: d.manifestPaths,
-			ecosystem: d.ecosystem || "maven",
-			ecosystemType: d.ecosystemType,
-			isDev: !!d.isDev,
-		});
+		// Query every distinct concrete version (e.g. two profiles pinning the
+		// same g:a), not just the representative highest — otherwise a vuln that
+		// only affects a lower-versioned variant would be missed.
+		const versions = (d.versions && d.versions.length) ? d.versions : [d.version];
+		for (const ver of versions) {
+			if (!ver || /\$\{|SNAPSHOT/i.test(ver)) continue;
+			// npm version specifiers like "^1.0.0" can't be queried against OSV —
+			// need a concrete version. Lockfiles always provide one; package.json-
+			// only deps are skipped here.
+			if (d.ecosystem === "npm" && /^[\^~>=<*]|^(latest|next|workspace:|git\+|file:|link:)/.test(ver)) continue;
+			deps.push({
+				groupId: d.groupId, artifactId: d.artifactId, version: ver,
+				scope: d.scope, via: d.via, depth: d.depth, pomPaths: d.pomPaths,
+				manifestPaths: d.manifestPaths,
+				ecosystem: d.ecosystem || "maven",
+				ecosystemType: d.ecosystemType,
+				isDev: !!d.isDev,
+			});
+		}
 	}
 	return queryBatch(deps, opts);
 }

package/lib/outdated.js

@@ -9,6 +9,7 @@ const fs = require("fs");
 const path = require("path");
 const os = require("os");
 const { compareMavenVersions } = require("./maven-version");
+const { webjarToNpm } = require("./npm/collect");
 
 const KNOWN_OBSOLETE = require("../data/known-obsolete.json");
 const EOL_MAPPING = require("../data/eol-mapping.json");
@@ -39,6 +40,23 @@ function isEolCacheFresh(maxAge = EOL_CACHE_MAX_AGE_MS) {
 // -------- EOL via endoflife.date --------
 
 function findEolProduct(dep) {
+	// npm packages — and WebJars, which are client-side JS shipped as Maven
+	// artifacts — resolve by JS library name, not Maven coordinate. npm deps
+	// use their name directly; WebJars are reduced to their npm-equivalent name
+	// first (org.webjars:angularjs → "angularjs", org.webjars.npm:angular__core
+	// → "@angular/core"). The npm package literally named "angular" is AngularJS
+	// 1.x; modern Angular is the @angular/* scope — hence the name vs. scope maps.
+	const npmName = dep.ecosystem === "npm" ? (dep.artifactId || "") : webjarToNpm(dep)?.name;
+	if (npmName != null) {
+		const byName = EOL_MAPPING.by_npm_name?.[npmName];
+		if (byName) return byName;
+		const scopes = Object.keys(EOL_MAPPING.by_npm_scope || {})
+			.sort((a, b) => b.length - a.length);
+		for (const s of scopes) {
+			if (npmName.startsWith(s)) return EOL_MAPPING.by_npm_scope[s];
+		}
+		return null;
+	}
 	const key = `${dep.groupId}:${dep.artifactId}`;
 	const direct = EOL_MAPPING.by_group_artifact?.[key];
 	if (direct) return direct;
@@ -104,7 +122,6 @@ async function checkEolDeps(resolvedDeps, opts = {}) {
 	const seen = new Set();
 
 	for (const dep of resolvedDeps.values()) {
-		if (dep.ecosystem === "npm") continue; // EOL mapping is Maven-only for now
 		const product = findEolProduct(dep);
 		if (!product) continue;
 		const dedupeKey = `${dep.groupId}:${dep.artifactId}|${product.product}`;

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "fad-checker",
-  "version": "1.0.4",
-  "description": "Fucking Autonomous Dependency Checker — multi-ecosystem CVE / EOL / outdated / vendored-JS scanner for Maven, npm and Yarn monorepos. Self-contained HTML + Word report.",
+  "version": "1.0.6",
+  "description": "Fucking Autonomous Dependency Checker — Scans ALL pom/bom, npm/Yarn stuff and vendored JavaScript in a source tree, deal with private deps, multi modules & produces 1 HTML/DOC report with CVE, EOL, obsolete, outdated deps & fix recos",
   "license": "MIT",
+  "repository": "https://github.com/n8tz/fad-checker",
   "author": "pp9Ping <pp9Ping@gmail.com>",
   "maintainers": [
     "pp9Ping <pp9Ping@gmail.com>"

package/test/cve-match.test.js

@@ -133,6 +133,46 @@ test("collectResolvedDeps keeps highest version on conflict", async () => {
 	if (lang) assert.equal(lang.version, "3.12.0");
 });
 
+test("collectResolvedDeps records every distinct version (e.g. two profiles)", () => {
+	const depXml = (g, a, v) => ({ groupId: [g], artifactId: [a], version: [v], scope: ["compile"] });
+	const store = { byPath: { a: {}, b: {} }, byId: {} };
+	// Same g:a pinned to different versions in two modules/profiles.
+	const props = {
+		a: { properties: {}, dependencies: [depXml("com.x", "y", "1.0.0")], dependencyManagement: [] },
+		b: { properties: {}, dependencies: [depXml("com.x", "y", "2.0.0")], dependencyManagement: [] },
+	};
+	const deps = collectResolvedDeps(store, props, {});
+	const y = deps.get("com.x:y");
+	assert.ok(y, "the dep is collected once, keyed by g:a");
+	assert.equal(y.version, "2.0.0", "representative version is still the highest");
+	assert.deepEqual([...y.versions].sort(), ["1.0.0", "2.0.0"], "both distinct versions are tracked");
+});
+
+test("matchDepsAgainstCves scans every distinct version, not just the highest", () => {
+	// A CVE that only affects the OLD version. Profiles pin 2.14.0 (vulnerable)
+	// and 2.20.0 (patched); the highest is patched, so deduping on max would
+	// hide the real exposure. Each distinct version must be scanned.
+	const idx = {
+		byPackageName: {
+			"org.apache.logging.log4j:log4j-core": [
+				{ id: "CVE-OLD-0001", severity: "CRITICAL", vendor: "apache", product: "log4j-core",
+				  ranges: [{ version: "2.0", lessThan: "2.15.0", status: "affected" }] },
+			],
+		},
+		byProduct: {},
+	};
+	const deps = new Map([
+		["org.apache.logging.log4j:log4j-core", {
+			groupId: "org.apache.logging.log4j", artifactId: "log4j-core",
+			version: "2.20.0", versions: ["2.14.0", "2.20.0"], scope: "compile", pomPaths: [],
+		}],
+	]);
+	const matches = matchDepsAgainstCves(deps, idx);
+	assert.equal(matches.length, 1, "vulnerable 2.14.0 must be flagged despite 2.20.0 being highest");
+	assert.equal(matches[0].cve.id, "CVE-OLD-0001");
+	assert.equal(matches[0].dep.version, "2.14.0", "match carries the actually-vulnerable version");
+});
+
 test("collectResolvedDeps --ignore-test drops test-scope deps", async () => {
 	const { store, props } = await pipeline(COMPLEX);
 	const withTest = collectResolvedDeps(store, props, {});

package/test/npm-registry.test.js

@@ -0,0 +1,64 @@
+const { test } = require("node:test");
+const assert = require("node:assert/strict");
+const { packumentToFindings } = require("../lib/npm/registry");
+
+const dep = (name, version) => ({ ecosystem: "npm", groupId: "", artifactId: name, version });
+
+test("packumentToFindings flags a deprecated resolved version", () => {
+	const packument = {
+		name: "request",
+		"dist-tags": { latest: "2.88.2" },
+		versions: {
+			"2.88.2": { deprecated: "request has been deprecated, see https://github.com/request/request/issues/3142" },
+		},
+		time: { "2.88.2": "2020-02-11T00:00:00.000Z" },
+	};
+	const { deprecated, outdated } = packumentToFindings(packument, dep("request", "2.88.2"));
+	assert.ok(deprecated, "should return a deprecated finding");
+	assert.match(deprecated.reason, /has been deprecated/);
+	assert.equal(deprecated.source, "npm");
+	assert.equal(deprecated.dep.artifactId, "request");
+	// Latest === current, so not outdated.
+	assert.equal(outdated, null);
+});
+
+test("packumentToFindings extracts a replacement URL from the deprecation message", () => {
+	const packument = {
+		"dist-tags": { latest: "1.0.0" },
+		versions: { "1.0.0": { deprecated: "use the foo package instead, see https://example.com/why" } },
+	};
+	const { deprecated } = packumentToFindings(packument, dep("bar", "1.0.0"));
+	assert.equal(deprecated.replacement, "https://example.com/why");
+});
+
+test("packumentToFindings reports outdated when latest is newer", () => {
+	const packument = {
+		"dist-tags": { latest: "3.7.1" },
+		versions: { "3.6.0": {} },
+		time: { "3.7.1": "2023-08-28T00:00:00.000Z" },
+	};
+	const { deprecated, outdated } = packumentToFindings(packument, dep("jquery", "3.6.0"));
+	assert.equal(deprecated, null, "not deprecated");
+	assert.ok(outdated, "should be outdated");
+	assert.equal(outdated.latest, "3.7.1");
+	assert.equal(outdated.releaseDate, "2023-08-28");
+});
+
+test("packumentToFindings returns nothing for an up-to-date, non-deprecated dep", () => {
+	const packument = {
+		"dist-tags": { latest: "4.18.2" },
+		versions: { "4.18.2": {} },
+	};
+	const { deprecated, outdated } = packumentToFindings(packument, dep("express", "4.18.2"));
+	assert.equal(deprecated, null);
+	assert.equal(outdated, null);
+});
+
+test("packumentToFindings tolerates a missing version entry", () => {
+	// Resolved version not present in the registry (e.g. unpublished) — must not throw.
+	const packument = { "dist-tags": { latest: "2.0.0" }, versions: { "2.0.0": {} } };
+	const { deprecated, outdated } = packumentToFindings(packument, dep("ghost", "1.5.0"));
+	assert.equal(deprecated, null);
+	assert.ok(outdated, "1.5.0 < 2.0.0 so still outdated");
+	assert.equal(outdated.latest, "2.0.0");
+});

package/test/outdated.test.js

@@ -54,3 +54,48 @@ test("findEolProduct picks longest prefix match", () => {
 	assert.equal(sec.product, "spring-framework");
 	assert.equal(sec.label, "Spring Security");
 });
+
+test("findEolProduct maps the npm 'angular' package to AngularJS 1.x", () => {
+	// The literal npm package named "angular" IS AngularJS (1.x), EOL since 2022.
+	const a = findEolProduct({ ecosystem: "npm", groupId: "", artifactId: "angular" });
+	assert.equal(a.product, "angularjs");
+	assert.equal(a.label, "AngularJS");
+});
+
+test("findEolProduct maps @angular/* scoped packages to modern Angular", () => {
+	const core = findEolProduct({ ecosystem: "npm", groupId: "", artifactId: "@angular/core" });
+	assert.equal(core.product, "angular");
+	const router = findEolProduct({ ecosystem: "npm", groupId: "", artifactId: "@angular/router" });
+	assert.equal(router.product, "angular");
+});
+
+test("findEolProduct maps react / react-dom / jquery / vue / bootstrap", () => {
+	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "react" }).product, "react");
+	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "react-dom" }).product, "react");
+	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "jquery" }).product, "jquery");
+	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "vue" }).product, "vue");
+	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "bootstrap" }).product, "bootstrap");
+});
+
+test("findEolProduct returns null for an unmapped npm package", () => {
+	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "left-pad" }), null);
+	// A Maven groupId must never leak into the npm lookup.
+	assert.equal(findEolProduct({ ecosystem: "npm", artifactId: "org.springframework" }), null);
+});
+
+test("findEolProduct maps WebJars (client-side JS shipped as Maven artifacts)", () => {
+	// org.webjars:angularjs:1.8.3 — AngularJS 1.x, EOL since 2021.
+	const ajs = findEolProduct({ groupId: "org.webjars", artifactId: "angularjs", version: "1.8.3" });
+	assert.ok(ajs, "org.webjars:angularjs must map");
+	assert.equal(ajs.product, "angularjs");
+
+	assert.equal(findEolProduct({ groupId: "org.webjars", artifactId: "jquery" }).product, "jquery");
+	assert.equal(findEolProduct({ groupId: "org.webjars", artifactId: "bootstrap" }).product, "bootstrap");
+	// org.webjars.npm mirrors npm names; scope slash is encoded as "__".
+	assert.equal(findEolProduct({ groupId: "org.webjars.npm", artifactId: "vue" }).product, "vue");
+	assert.equal(findEolProduct({ groupId: "org.webjars.npm", artifactId: "angular__core" }).product, "angular");
+});
+
+test("findEolProduct returns null for an unmapped WebJar artifact", () => {
+	assert.equal(findEolProduct({ groupId: "org.webjars", artifactId: "datatables" }), null);
+});

package/test/webjar.test.js

@@ -0,0 +1,33 @@
+const { test } = require("node:test");
+const assert = require("node:assert/strict");
+const { webjarToNpm } = require("../lib/npm/collect");
+
+test("webjarToNpm derives the npm name from org.webjars.npm (deterministic mirror)", () => {
+	assert.deepEqual(
+		webjarToNpm({ groupId: "org.webjars.npm", artifactId: "react", version: "18.2.0" }),
+		{ name: "react", version: "18.2.0" },
+	);
+	// Scoped packages encode "@scope/name" as "scope__name".
+	assert.deepEqual(
+		webjarToNpm({ groupId: "org.webjars.npm", artifactId: "angular__core", version: "17.2.3" }),
+		{ name: "@angular/core", version: "17.2.3" },
+	);
+});
+
+test("webjarToNpm passes classic org.webjars artifactIds through as-is", () => {
+	// Classic WebJars are hand-curated; the artifactId is the JS lib name.
+	assert.deepEqual(
+		webjarToNpm({ groupId: "org.webjars", artifactId: "angularjs", version: "1.8.3" }),
+		{ name: "angularjs", version: "1.8.3" },
+	);
+	assert.equal(webjarToNpm({ groupId: "org.webjars", artifactId: "jquery", version: "3.7.1" }).name, "jquery");
+});
+
+test("webjarToNpm handles bower webjars too", () => {
+	assert.equal(webjarToNpm({ groupId: "org.webjars.bowergithub.foo", artifactId: "bar", version: "1.0.0" }).name, "bar");
+});
+
+test("webjarToNpm returns null for non-webjar coordinates", () => {
+	assert.equal(webjarToNpm({ groupId: "org.springframework", artifactId: "spring-core", version: "6.0.0" }), null);
+	assert.equal(webjarToNpm({ ecosystem: "npm", groupId: "", artifactId: "react", version: "18.0.0" }), null);
+});