fad-checker 2.0.1 → 2.1.0

package/lib/json-export.js

@@ -0,0 +1,110 @@
+/**
+ * lib/json-export.js — emit a single machine-readable findings document.
+ *
+ * Unlike the CycloneDX SBOM (component-centric) or CSAF VEX (status-centric),
+ * this is fad-checker's own flat findings format: every chapter (CVE, EOL,
+ * obsolete, outdated, licenses, vendored) in one JSON, easy to diff between
+ * audits and post-process. buildFindings is pure; writeFindings writes it.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const { purlFor } = require("./purl");
+
+function coordOf(dep) {
+	const ns = dep.namespace || dep.groupId || "";
+	const name = dep.name || dep.artifactId;
+	if (dep.ecosystem === "maven" && ns) return `${ns}:${name}`;
+	if (dep.ecosystem === "composer" && ns) return `${ns}/${name}`;
+	return name;
+}
+
+function depBrief(dep) {
+	return {
+		ecosystem: dep.ecosystem,
+		coord: coordOf(dep),
+		version: dep.version || null,
+		scope: dep.scope || null,
+		isDev: !!dep.isDev,
+		provenance: dep.provenance || "manifest",
+		purl: purlFor(dep),
+		manifestPaths: dep.manifestPaths || dep.pomPaths || [],
+	};
+}
+
+function cveFinding(m) {
+	const c = m.cve;
+	return {
+		id: c.id,
+		severity: c.severity || "UNKNOWN",
+		cvss: c.score ?? null,
+		cvssVector: c.cvssVector || null,
+		epss: c.epssScore ?? null,
+		epssPercentile: c.epssPercentile ?? null,
+		kev: !!c.kev,
+		kevDueDate: c.kevDueDate || null,
+		priority: c.priority ? { band: c.priority.band, score: c.priority.score } : null,
+		cwes: c.cwes || [],
+		fixVersion: c.fixVersion || null,
+		source: m.source || null,
+		confidence: m.confidence || null,
+		cpeFiltered: !!m.cpeFiltered,
+		suppressed: !!m.suppressed,
+		suppressedReason: m.suppressedReason || null,
+		dep: depBrief(m.dep),
+	};
+}
+
+const SEV = ["critical", "high", "medium", "low", "none", "unknown"];
+
+/**
+ * Build the findings document.
+ * payload: { cveMatches, retireMatches, eolResults, obsoleteResults,
+ *            outdatedResults, licenseResults, resolvedDeps, projectInfo, toolVersion }
+ */
+function buildFindings(payload = {}) {
+	const {
+		cveMatches = [], retireMatches = [], eolResults = [], obsoleteResults = [],
+		outdatedResults = [], licenseResults = null, resolvedDeps, projectInfo = {}, toolVersion = "0",
+	} = payload;
+
+	const sevCounts = Object.fromEntries(SEV.map(s => [s, 0]));
+	let kev = 0;
+	for (const m of cveMatches) {
+		if (m.cpeFiltered || m.suppressed) continue;
+		const s = (m.cve.severity || "unknown").toLowerCase();
+		sevCounts[s != null && sevCounts[s] != null ? s : "unknown"]++;
+		if (m.cve.kev) kev++;
+	}
+
+	return {
+		tool: { name: "fad-checker", version: String(toolVersion) },
+		generatedAt: projectInfo.generatedAt || null,
+		project: { name: projectInfo.name || null, src: projectInfo.src || null },
+		summary: {
+			dependencies: resolvedDeps?.size ?? null,
+			cve: { ...sevCounts, kev, total: cveMatches.filter(m => !m.cpeFiltered && !m.suppressed).length },
+			eol: eolResults.length,
+			obsolete: obsoleteResults.length,
+			outdated: outdatedResults.length,
+			licensesFlagged: licenseResults?.flagged?.length || 0,
+			vendored: retireMatches.length,
+			suppressed: cveMatches.filter(m => m.suppressed).length,
+		},
+		cve: cveMatches.map(cveFinding),
+		vendored: retireMatches.map(cveFinding),
+		eol: eolResults.map(e => ({ product: e.product, eol: e.eol, dep: depBrief(e.dep) })),
+		obsolete: obsoleteResults.map(o => ({ reason: o.reason || null, replacement: o.replacement || null, source: o.source || null, dep: depBrief(o.dep) })),
+		outdated: outdatedResults.map(o => ({ latest: o.latest, releaseDate: o.releaseDate || null, dep: depBrief(o.dep) })),
+		licenses: (licenseResults?.assessed || []).map(e => ({ category: e.category, licenses: e.ids.concat(e.raw), source: e.source || null, dep: depBrief(e.dep) })),
+	};
+}
+
+function writeFindings(payload, outputPath) {
+	const doc = buildFindings(payload);
+	fs.writeFileSync(outputPath, JSON.stringify(doc, null, 2) + "\n");
+	return doc;
+}
+
+module.exports = { buildFindings, writeFindings };

package/lib/kev.js

@@ -0,0 +1,88 @@
+/**
+ * lib/kev.js — enrich matches with CISA KEV (Known Exploited Vulnerabilities).
+ *
+ * KEV is a single authoritative catalogue of CVEs CISA has observed being
+ * exploited in the wild. Membership is the strongest "patch this now" signal.
+ *
+ * Feed: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
+ * Cache: ~/.fad-checker/kev-cache.json, 24h TTL.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+
+const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
+const CACHE_PATH = path.join(CACHE_DIR, "kev-cache.json");
+const CACHE_TTL_MS = 24 * 3600 * 1000;
+const KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json";
+
+function readCache() {
+	try {
+		const data = JSON.parse(fs.readFileSync(CACHE_PATH, "utf8"));
+		if (Date.now() - data._fetchedAt < CACHE_TTL_MS) return data.body;
+	} catch { /* ignore */ }
+	return null;
+}
+
+function writeCache(body) {
+	try {
+		fs.mkdirSync(CACHE_DIR, { recursive: true });
+		fs.writeFileSync(CACHE_PATH, JSON.stringify({ _fetchedAt: Date.now(), body }));
+	} catch { /* ignore */ }
+}
+
+/** Pure: KEV catalogue JSON → { byId: { cveID: {dateAdded, dueDate, ransomware} } }. */
+function indexKevCatalog(json) {
+	const byId = {};
+	for (const v of json?.vulnerabilities || []) {
+		if (!v?.cveID) continue;
+		byId[v.cveID] = {
+			dateAdded: v.dateAdded || null,
+			dueDate: v.dueDate || null,
+			ransomware: /^known$/i.test(v.knownRansomwareCampaignUse || ""),
+		};
+	}
+	return { byId };
+}
+
+/**
+ * Enrich matches in place: sets cve.kev / cve.kevDateAdded / cve.kevDueDate /
+ * cve.kevRansomware for CVEs present in the catalogue.
+ * opts: { offline, verbose, fetcher }
+ */
+async function enrichKev(matches, opts = {}) {
+	const { offline, verbose, fetcher = globalThis.fetch } = opts;
+	const hasCve = (matches || []).some(m => m.cve?.id?.startsWith("CVE-"));
+	if (!hasCve) return matches;
+
+	let index = readCache();
+	if (!index && !offline) {
+		try {
+			const r = await fetcher(KEV_URL, { headers: { "User-Agent": "fad-checker-kev" } });
+			if (r.ok) {
+				index = indexKevCatalog(await r.json());
+				writeCache(index);
+			} else if (verbose) {
+				console.warn(`   KEV HTTP ${r.status}`);
+			}
+		} catch (err) {
+			if (verbose) console.warn(`   KEV fetch failed: ${err.message}`);
+		}
+	}
+	if (!index) return matches;
+
+	for (const m of matches || []) {
+		const hit = index.byId[m.cve?.id];
+		if (!hit) continue;
+		m.cve.kev = true;
+		m.cve.kevDateAdded = hit.dateAdded;
+		m.cve.kevDueDate = hit.dueDate;
+		m.cve.kevRansomware = hit.ransomware;
+	}
+	return matches;
+}
+
+module.exports = { enrichKev, indexKevCatalog, CACHE_PATH };

package/lib/license-policy.js

@@ -0,0 +1,110 @@
+/**
+ * lib/license-policy.js — normalize free-form license strings to SPDX ids and
+ * classify them into policy categories (permissive / copyleft / proprietary).
+ *
+ * Data-driven: data/license-policy.json holds the id→category table and an
+ * alias map for the messy real-world strings registries and POMs emit
+ * ("Apache 2.0", "The MIT License", "GNU GPLv3", …). Pure — no I/O at call time.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const path = require("path");
+
+const POLICY = (() => {
+	try {
+		const raw = JSON.parse(fs.readFileSync(path.join(__dirname, "..", "data", "license-policy.json"), "utf8"));
+		return { categories: raw.categories || {}, aliases: raw.aliases || {} };
+	} catch { return { categories: {}, aliases: {} }; }
+})();
+
+// Case-insensitive index of canonical SPDX ids for direct matches.
+const CANON_BY_LOWER = new Map(Object.keys(POLICY.categories).map(id => [id.toLowerCase(), id]));
+
+const FLAGGED_CATEGORIES = new Set(["strong-copyleft", "network-copyleft", "proprietary", "unknown"]);
+// Most-restrictive-wins order when a dep has several licenses.
+const CATEGORY_RANK = { permissive: 1, unknown: 2, "weak-copyleft": 3, proprietary: 4, "strong-copyleft": 5, "network-copyleft": 6 };
+
+/** Normalize one license token to a canonical SPDX id, or null if unknown. */
+function normalizeSpdx(raw) {
+	if (raw == null) return null;
+	// npm sometimes uses { type, url } objects.
+	const s = (typeof raw === "object" ? (raw.type || raw.name || "") : String(raw)).trim();
+	if (!s) return null;
+	const lower = s.toLowerCase();
+	if (CANON_BY_LOWER.has(lower)) return CANON_BY_LOWER.get(lower);
+	if (POLICY.aliases[lower]) return POLICY.aliases[lower];
+	// Tolerate a trailing "+" (or-later) and "-only" decorations.
+	const stripped = lower.replace(/\+$/, "").trim();
+	if (CANON_BY_LOWER.has(stripped)) return CANON_BY_LOWER.get(stripped);
+	if (POLICY.aliases[stripped]) return POLICY.aliases[stripped];
+	return null;
+}
+
+/** Split an SPDX expression / array / "A OR B" / "A/B" string into raw tokens. */
+function splitExpression(raw) {
+	if (Array.isArray(raw)) return raw.flatMap(splitExpression);
+	if (raw == null) return [];
+	if (typeof raw === "object") return [raw.type || raw.name || ""].filter(Boolean);
+	return String(raw)
+		.replace(/[()]/g, " ")
+		.split(/\s+(?:OR|AND)\s+|\s+WITH\s+|[,/|]/i)
+		.map(t => t.trim())
+		.filter(Boolean);
+}
+
+/** Category for a canonical SPDX id (defaults to "unknown"). */
+function classify(spdxId) {
+	if (!spdxId) return "unknown";
+	return POLICY.categories[spdxId] || "unknown";
+}
+
+/**
+ * Resolve a dep's raw license value(s) into { ids, raw, category }.
+ * `ids` are canonical SPDX (raw token kept when unmapped); `category` is the
+ * most restrictive among them.
+ */
+function resolveDepLicense(rawValue) {
+	const tokens = splitExpression(rawValue);
+	if (!tokens.length) return { ids: [], raw: [], category: "unknown" };
+	const ids = [];
+	const rawKept = [];
+	let best = "permissive";
+	let bestRank = 0;
+	let anyKnown = false;
+	for (const tok of tokens) {
+		const id = normalizeSpdx(tok);
+		if (id) { ids.push(id); anyKnown = true; } else rawKept.push(tok);
+		const cat = id ? classify(id) : "unknown";
+		const rank = CATEGORY_RANK[cat] || CATEGORY_RANK.unknown;
+		if (rank > bestRank) { bestRank = rank; best = cat; }
+	}
+	// All tokens unmapped → unknown overall.
+	if (!anyKnown) best = "unknown";
+	return { ids, raw: rawKept, category: best };
+}
+
+/**
+ * Assess a flat list of license findings.
+ * findings: [{ dep, licenses: <raw string|array|object>, source }]
+ * Returns { assessed: [{dep, source, ids, raw, category}], byCategory, flagged }.
+ */
+function assessLicenses(findings) {
+	const assessed = [];
+	const byCategory = {};
+	const flagged = [];
+	for (const f of findings || []) {
+		const r = resolveDepLicense(f.licenses);
+		const entry = { dep: f.dep, source: f.source || null, ids: r.ids, raw: r.raw, category: r.category };
+		assessed.push(entry);
+		(byCategory[r.category] = byCategory[r.category] || []).push(entry);
+		if (FLAGGED_CATEGORIES.has(r.category)) flagged.push(entry);
+	}
+	return { assessed, byCategory, flagged };
+}
+
+module.exports = {
+	normalizeSpdx, splitExpression, classify, resolveDepLicense, assessLicenses,
+	FLAGGED_CATEGORIES, CATEGORY_RANK,
+};

package/lib/maven-license.js

@@ -0,0 +1,52 @@
+/**
+ * lib/maven-license.js — best-effort Maven license detection, network-free.
+ *
+ * A declaring POM only lists a dependency's coordinate, not its license — the
+ * license lives in the dependency's OWN POM on Maven Central. transitive.js
+ * already caches those POMs under ~/.fad-checker/poms-cache/. We read the cached
+ * POMs (no network) and scrape the <licenses><license><name> block. Deps whose
+ * POM was never cached simply yield no license (→ unknown in the policy view).
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const path = require("path");
+const { POM_CACHE_DIR } = require("./transitive");
+
+function cachedPomPath(g, a, v, dir) {
+	return path.join(dir, `${String(g).replace(/[/\\]/g, "_")}__${a}__${v}.pom`);
+}
+
+/** Pure: extract license names from a POM's <licenses> block. */
+function licensesFromPomXml(xml) {
+	if (!xml) return [];
+	const block = xml.match(/<licenses>([\s\S]*?)<\/licenses>/i);
+	if (!block) return [];
+	const names = [];
+	const re = /<name>\s*([^<]+?)\s*<\/name>/gi;
+	let m;
+	while ((m = re.exec(block[1]))) names.push(m[1].trim());
+	return names.filter(Boolean);
+}
+
+/**
+ * Collect license findings for every Maven dep with a cached POM.
+ * opts: { cacheDir = POM_CACHE_DIR }
+ * Returns [{ dep, licenses: [name…], source: "pom" }].
+ */
+function collectMavenLicenses(resolved, opts = {}) {
+	const cacheDir = opts.cacheDir || POM_CACHE_DIR;
+	const out = [];
+	for (const dep of resolved.values()) {
+		if (dep.ecosystem !== "maven" || !dep.version) continue;
+		const p = cachedPomPath(dep.namespace || dep.groupId, dep.name || dep.artifactId, dep.version, cacheDir);
+		let xml;
+		try { xml = fs.readFileSync(p, "utf8"); } catch { continue; }
+		const names = licensesFromPomXml(xml);
+		if (names.length) out.push({ dep, licenses: names, source: "pom" });
+	}
+	return out;
+}
+
+module.exports = { collectMavenLicenses, licensesFromPomXml };

package/lib/maven-repo.js

@@ -17,6 +17,9 @@
  *
  * The first 2xx wins. Misses are silently aggregated; the caller decides
  * what to do with "not found anywhere".
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const MAVEN_CENTRAL = { name: "central", url: "https://repo1.maven.org/maven2/" };
 

package/lib/maven-version.js

@@ -9,6 +9,9 @@
  *       alpha < beta < milestone < rc < snapshot < "" (release) < sp
  *   - Trailing zeros are insignificant: 1.0 == 1.0.0 == 1.
  *   - Known release qualifiers (final, release, ga) are treated as "".
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 
 // Lower number == lower precedence
@@ -65,12 +68,14 @@ function cmpSegments(a, b) {
 	}
 	if (a.kind === "num" && b.kind === "num") return a.value - b.value;
 	if (a.kind === "num") {
-		// number vs qualifier — numbers are "newer" than pre-release qualifiers
-		const r = qualifierRank(b.value);
+		// number vs qualifier — numbers are "newer" than pre-release qualifiers.
+		// qualOf() reads the qualifier from BOTH str and qual+num segments (a bare
+		// `.value` is undefined for qual+num and would mis-rank e.g. "1.0.rc1").
+		const r = qualifierRank(qualOf(b));
 		return r < QUALIFIER_ORDER[""] ? 1 : -1;
 	}
 	if (b.kind === "num") {
-		const r = qualifierRank(a.value);
+		const r = qualifierRank(qualOf(a));
 		return r < QUALIFIER_ORDER[""] ? -1 : 1;
 	}
 	if (a.kind === "qual+num" && b.kind === "qual+num") {

package/lib/nvd.js

@@ -10,6 +10,9 @@
  * Rate limit: 5 req / 30s unauthenticated, 50 req / 30s with NVD_API_KEY env var.
  *
  * Cache: ~/.fad-checker/nvd-cache/<cve-id>.json, 7-day TTL.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");
@@ -62,11 +65,15 @@ function writeCache(cveId, body) {
 function bestMetric(metrics) {
 	// NVD 2.0 returns metrics organised by version: cvssMetricV40, V31, V30, V2
 	const order = ["cvssMetricV40", "cvssMetricV31", "cvssMetricV30", "cvssMetricV2"];
+	// Proper CVSS version label — NOT "cvssMetricV31".replace(...) which yielded the
+	// malformed "CVSS:V31" that downstream consumers (csaf cvssV3Version, sbom
+	// cvssMethod, the report) test with .includes("3.1") and so always missed.
+	const VER = { cvssMetricV40: "CVSS:4.0", cvssMetricV31: "CVSS:3.1", cvssMetricV30: "CVSS:3.0", cvssMetricV2: "CVSS:2.0" };
 	for (const k of order) {
 		if (Array.isArray(metrics?.[k]) && metrics[k].length) {
 			const cv = metrics[k][0].cvssData;
 			return {
-				version: k.replace("cvssMetric", "CVSS:"),
+				version: VER[k],
 				score: cv.baseScore,
 				severity: (cv.baseSeverity || severityFromScore(cv.baseScore) || "UNKNOWN").toUpperCase(),
 				vector: cv.vectorString,
@@ -266,8 +273,11 @@ async function enrichMatches(matches, opts = {}) {
 		}
 		if (m.cve.severity === "UNKNOWN" || !m.cve.severity) m.cve.severity = data.severity;
 		if (m.cve.score == null) m.cve.score = data.score;
-		m.cve.cvssVector = data.cvssVector || null;
-		m.cve.cvssVersion = data.cvssVersion || null;
+		// Only overwrite the vector/version when NVD actually has one — an NVD record
+		// without CVSS metrics must not clobber an OSV-derived vector/version (which is
+		// what feeds CSAF cvssV3Version + SBOM cvssMethod).
+		if (data.cvssVector) m.cve.cvssVector = data.cvssVector;
+		if (data.cvssVersion) m.cve.cvssVersion = data.cvssVersion;
 		m.cve.nvdRefs = data.references || [];   // [{url, tags, source}]
 		m.cve.cpes = data.cpes || [];
 		m.cve.cwes = data.cwes || [];

package/lib/osv.js

@@ -12,6 +12,9 @@
  *   GET  /v1/vulns/{id}  to fetch full details
  *
  * Cached responses live in ~/.fad-checker/osv-cache/ for 12h.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");
@@ -50,31 +53,74 @@ function normalizeSeverity(s) {
 	return SEVERITY_ALIASES[up] || up;
 }
 
-/** Map an OSV severity score string ("9.8", "CVSS:3.1/AV:N/.../I:H/A:H") to a level. */
-function severityFromOsv(vuln) {
-	// Severity may live in `severity[]` (CVSS vector strings) or
-	// `database_specific.severity` (GHSA-style: "CRITICAL", "HIGH", "MODERATE"...).
-	const direct = vuln.database_specific?.severity;
-	if (direct) return { severity: normalizeSeverity(direct), score: scoreFromVuln(vuln) };
-	const sev = vuln.severity?.[0]?.score || "";
-	const numeric = parseFloat(sev.match(/(\d+(\.\d+)?)/)?.[1]);
-	if (Number.isFinite(numeric)) {
-		if (numeric >= 9) return { severity: "CRITICAL", score: numeric };
-		if (numeric >= 7) return { severity: "HIGH", score: numeric };
-		if (numeric >= 4) return { severity: "MEDIUM", score: numeric };
-		if (numeric > 0) return { severity: "LOW", score: numeric };
+function severityFromScore(n) {
+	if (!Number.isFinite(n)) return "UNKNOWN";
+	if (n >= 9) return "CRITICAL";
+	if (n >= 7) return "HIGH";
+	if (n >= 4) return "MEDIUM";
+	if (n > 0) return "LOW";
+	return "NONE";
+}
+
+// Compute a CVSS v3.0/3.1 base score from its vector string. Returns null for
+// non-v3 vectors (v2/v4) or anything unparseable. OSV stores the *vector* in
+// `severity[].score` for CVSS_V3 — there is NO bare base number to read, so the
+// old "first number in the string" approach extracted the VERSION ("3.1") as the
+// score, mislabelling HIGH findings as ~low everywhere downstream (SARIF
+// security-severity, priority banding, SBOM/CSAF ratings).
+function cvss3BaseScore(vector) {
+	const v = String(vector || "");
+	if (!/^CVSS:3\.[01]\//.test(v)) return null;
+	const p = {};
+	for (const kv of v.split("/").slice(1)) {
+		const [k, val] = kv.split(":");
+		if (k && val) p[k] = val;
 	}
-	return { severity: "UNKNOWN", score: null };
+	const AV = { N: 0.85, A: 0.62, L: 0.55, P: 0.2 }[p.AV];
+	const AC = { L: 0.77, H: 0.44 }[p.AC];
+	const UI = { N: 0.85, R: 0.62 }[p.UI];
+	const scopeChanged = p.S === "C";
+	const PR = scopeChanged
+		? { N: 0.85, L: 0.68, H: 0.5 }[p.PR]
+		: { N: 0.85, L: 0.62, H: 0.27 }[p.PR];
+	const imp = { H: 0.56, L: 0.22, N: 0 };
+	const C = imp[p.C], I = imp[p.I], A = imp[p.A];
+	if ([AV, AC, UI, PR, C, I, A].some(x => x == null)) return null;
+	const iss = 1 - (1 - C) * (1 - I) * (1 - A);
+	const impact = scopeChanged ? 7.52 * (iss - 0.029) - 3.25 * Math.pow(iss - 0.02, 15) : 6.42 * iss;
+	if (impact <= 0) return 0;
+	const exploit = 8.22 * AV * AC * PR * UI;
+	const base = Math.min(scopeChanged ? 1.08 * (impact + exploit) : impact + exploit, 10);
+	return Math.ceil(base * 10) / 10; // CVSS roundup to one decimal
 }
 
-function scoreFromVuln(vuln) {
+/** Best CVSS info from an OSV vuln: { score, vector, version } (version like "3.1"). */
+function cvssInfoFromVuln(vuln) {
 	for (const s of vuln.severity || []) {
-		const m = String(s.score || "").match(/(\d+(\.\d+)?)/);
-		if (m) return parseFloat(m[1]);
+		const str = String(s.score || "");
+		const mver = str.match(/^CVSS:(\d\.\d)\//);
+		if (mver) {
+			const version = mver[1];
+			const score = (version === "3.0" || version === "3.1") ? cvss3BaseScore(str) : null;
+			return { score, vector: str, version };
+		}
+		const mnum = str.match(/^\s*(\d+(\.\d+)?)\s*$/); // a bare numeric score ("9.8")
+		if (mnum) return { score: parseFloat(mnum[1]), vector: null, version: null };
 	}
-	return null;
+	return { score: null, vector: null, version: null };
 }
 
+/** Map an OSV vuln to { severity, score }. */
+function severityFromOsv(vuln) {
+	const direct = vuln.database_specific?.severity;
+	const { score } = cvssInfoFromVuln(vuln);
+	if (direct) return { severity: normalizeSeverity(direct), score };
+	if (score != null) return { severity: severityFromScore(score), score };
+	return { severity: "UNKNOWN", score: null };
+}
+
+function scoreFromVuln(vuln) { return cvssInfoFromVuln(vuln).score; }
+
 /** Extract the first fix version from OSV affected ranges (semver/ecosystem events). */
 function fixVersionFromOsv(vuln, depKey) {
 	for (const a of vuln.affected || []) {
@@ -97,7 +143,7 @@ function pickPrimaryId(vuln) {
 }
 
 // OSV ecosystem name per codec id. OSV.dev natively supports all of these.
-const OSV_ECO = { maven: "Maven", npm: "npm", yarn: "npm", nuget: "NuGet", composer: "Packagist", pypi: "PyPI" };
+const OSV_ECO = { maven: "Maven", npm: "npm", yarn: "npm", nuget: "NuGet", composer: "Packagist", pypi: "PyPI", go: "Go", ruby: "RubyGems" };
 
 /** OSV ecosystem string for a dep, derived from its codec id. */
 function osvEcosystemFor(dep) { return OSV_ECO[dep.ecosystem] || "Maven"; }
@@ -115,6 +161,7 @@ function osvPkgName(dep) {
 function vulnToMatch(dep, vuln) {
 	const id = pickPrimaryId(vuln);
 	const { severity, score } = severityFromOsv(vuln);
+	const cvss = cvssInfoFromVuln(vuln);
 	// `details` (long markdown) is the substantive description; `summary` is just the title.
 	// We keep them both: summary as headline, details as body.
 	const summary = (vuln.summary || "").trim();
@@ -137,6 +184,8 @@ function vulnToMatch(dep, vuln) {
 			id,
 			severity,
 			score,
+			...(cvss.vector ? { cvssVector: cvss.vector } : {}),
+			...(cvss.version ? { cvssVersion: `CVSS:${cvss.version}` } : {}),
 			description,
 			summary,
 			fixVersion: fixVersionFromOsv(vuln, osvPkgName(dep)),

package/lib/outdated.js

@@ -4,6 +4,9 @@
  * EOL data comes from endoflife.date (with on-disk cache).
  * Obsolete data is curated locally (data/known-obsolete.json).
  * Outdated comes from Maven Central's maven-metadata.xml.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");

package/lib/priority.js

@@ -0,0 +1,90 @@
+/**
+ * lib/priority.js — composite prioritisation of a CVE match.
+ *
+ * Blends three independent signals the report already carries:
+ *   - CVSS base score (severity of the flaw if exploited)
+ *   - EPSS percentile (likelihood it WILL be exploited — lib/epss.js)
+ *   - CISA KEV membership (it IS being exploited in the wild — lib/kev.js)
+ *
+ * KEV always wins (band "exploited", score floored at 90). Otherwise the score
+ * is an 80/20 blend of CVSS and EPSS percentile. Pure — no I/O.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+
+const SEV_SCORE = { CRITICAL: 9.5, HIGH: 7.5, MEDIUM: 5, LOW: 2, NONE: 0, UNKNOWN: 0 };
+
+function severityToScore(sev) {
+	return SEV_SCORE[(sev || "UNKNOWN").toUpperCase()] ?? 0;
+}
+
+function clamp(n, lo, hi) {
+	return Math.max(lo, Math.min(hi, n));
+}
+
+/**
+ * Compute a priority object for a cve sub-record.
+ * Returns { score (0-100), band, cvss, epssPercentile, kev, sortKey }.
+ */
+function computePriority(cve = {}) {
+	// A literal 0 is treated as "no CVSS" and we fall back to the severity label:
+	// enrichers emit null for scoreless CVEs, so a 0 here is a placeholder, and a
+	// CRITICAL-labelled finding must not band as "low" just because score===0.
+	const cvss = (typeof cve.score === "number" && cve.score > 0) ? cve.score : severityToScore(cve.severity);
+	const epssKnown = typeof cve.epssPercentile === "number";
+	const epssPercentile = epssKnown ? clamp(cve.epssPercentile, 0, 1) : 0;
+	const kev = !!cve.kev;
+
+	// When EPSS is known, blend 80% CVSS + 20% exploit-likelihood (so a known-low
+	// EPSS slightly deprioritises a high-CVSS flaw). When EPSS is absent we don't
+	// dilute — a CVSS 9.8 with no EPSS data must still read as critical.
+	let score = epssKnown
+		? clamp(cvss * 10 * 0.8 + epssPercentile * 100 * 0.2, 0, 100)
+		: clamp(cvss * 10, 0, 100);
+	let band;
+	if (kev) {
+		score = Math.max(score, 90);
+		band = "exploited";
+	} else if (score >= 90) band = "critical";
+	else if (score >= 70) band = "high";
+	else if (score >= 40) band = "medium";
+	else band = "low";
+
+	const rounded = Math.round(score * 10) / 10;
+	return {
+		score: rounded,
+		band,
+		cvss,
+		epssPercentile,
+		kev,
+		// Descending-sort tuple, aligned with the displayed score: exploited
+		// first, then the blended score (which already folds in CVSS + EPSS).
+		sortKey: [kev ? 1 : 0, rounded],
+	};
+}
+
+/** Attach m.cve.priority to every match in place. */
+function attachPriority(matches) {
+	for (const m of matches || []) {
+		if (m && m.cve) m.cve.priority = computePriority(m.cve);
+	}
+	return matches;
+}
+
+/** Compare two matches descending by priority sortKey, then CVE id ascending. */
+function comparePriority(a, b) {
+	const pa = a.cve?.priority || computePriority(a.cve);
+	const pb = b.cve?.priority || computePriority(b.cve);
+	for (let i = 0; i < pa.sortKey.length; i++) {
+		if (pb.sortKey[i] !== pa.sortKey[i]) return pb.sortKey[i] - pa.sortKey[i];
+	}
+	return (a.cve?.id || "").localeCompare(b.cve?.id || "");
+}
+
+/** Return a new array sorted descending by priority. */
+function sortByPriority(matches) {
+	return [...(matches || [])].sort(comparePriority);
+}
+
+module.exports = { computePriority, attachPriority, comparePriority, sortByPriority, severityToScore };