fad-checker 2.2.2 → 2.2.3

package/fad-checker.js

@@ -236,7 +236,10 @@ program
 	.option("--ignore-test", "skip test-scoped dependencies in report")
 	.option("--cve-refresh", "force re-download of CVE database")
 	.option("--cve-offline", "use cached CVE index only (no download)")
+	.option("--osv-db", "import + match the full local OSV database (Maven) — offline-complete recall, independent of the per-dep OSV cache")
+	.option("--osv-db-refresh", "force re-download of the local OSV database")
 	.option("--snyk", "run snyk on cleaned POMs and merge into report (requires --target)")
+	.option("--typosquat", "flag npm/PyPI deps whose name is one edit from a popular package (heuristic typosquat/slopsquat detection)")
 	.option("--no-retire", "skip retire.js vendored-JS scan")
 	.option("--no-vendored-js-inventory", "don't list ALL identified vendored JS libs (chapter 1D) — keep only the vulnerable ones (chapter 2)")
 	.option("--retire-refresh", "ignore retire cache and re-scan")
@@ -750,6 +753,9 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		? require("./lib/maven-bom").collectImportBoms(mavenPropsByPom) : [];
 	const willBom = importBoms.length > 0;
 	const willOsv = !!options.osv;
+	// Local OSV DB import (Maven): offline-complete OSV recall, independent of the per-dep
+	// OSV.dev cache. Opt-in (downloads ~9 MB once); then matches online or offline.
+	const willOsvDb = !!options.osvDb && runMaven;
 	const willOutdated = !!options.allLibs;
 	const willNvd = !!options.nvd;
 	const willEpss = !!options.epss;
@@ -760,7 +766,7 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	const willBinaryId = [...resolved.values()].some(d => d.provenance === "binary");
 	// License detection piggybacks on the registry passes (same fetched metadata),
 	// so it adds no progress step of its own.
-	const totalSteps = [willBom, willTransitive, willOverlay, willCve, /*EOL*/ true, willOutdated, /*npm reg*/ true, ...otherRegistryIds.map(() => true), willOsv, willNvd, willEpss, willKev, willRetire, willBinaryId].filter(Boolean).length;
+	const totalSteps = [willBom, willTransitive, willOverlay, willCve, /*EOL*/ true, willOutdated, /*npm reg*/ true, ...otherRegistryIds.map(() => true), willOsv, willOsvDb, willNvd, willEpss, willKev, willRetire, willBinaryId].filter(Boolean).length;
 	const progress = new ui.Progress(totalSteps);
 
 	if (willBom) {
@@ -912,6 +918,25 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		}
 	}
 
+	// 4b'. Local OSV database (Maven) — offline-COMPLETE recall. The per-dep OSV.dev
+	// queries above only cover deps cached online; the imported full OSV DB matches every
+	// dep offline, deterministically, regardless of cache warmth (the OSV-Scanner model).
+	if (willOsvDb) {
+		const st = progress.start("OSV database (local, Maven)");
+		try {
+			const { ensureOsvDb, matchOsvDbDeps } = require("./lib/osv-db");
+			const index = await ensureOsvDb({ offline, refresh: !!options.osvDbRefresh, verbose, ecosystem: "maven" });
+			if (!index) {
+				st.done(offline ? "no local OSV DB (run once online with --osv-db)" : "unavailable");
+			} else {
+				const dbMatches = matchOsvDbDeps(resolved, index);
+				const before = cveMatches.length;
+				cveMatches = mergeBySource(cveMatches, dbMatches);
+				st.done(`${index.count} advisories · ${dbMatches.length} matched · +${cveMatches.length - before} new`);
+			}
+		} catch (err) { st.fail(err.message); }
+	}
+
 	// 4c. NVD enrichment — canonical description + full CVSS for matched CVEs.
 	if (willNvd) {
 		const st = progress.start("NVD enrichment");
@@ -1019,6 +1044,22 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		}
 	}
 
+	// 6b. Supply-chain risk lane (pure + offline): flag KNOWN-MALICIOUS advisories
+	// (OSV MAL-… already in the match set) always, and detect suspected TYPOSQUATS
+	// (opt-in --typosquat, heuristic — names one edit from a popular package).
+	const { flagMalicious, detectTyposquats } = require("./lib/malware");
+	const maliciousCount = flagMalicious(cveMatches);
+	const typosquats = options.typosquat ? detectTyposquats(resolved) : [];
+	if (maliciousCount || typosquats.length) {
+		ui.section("Supply-chain risk");
+		if (maliciousCount) ui.warn(chalk.red.bold(`${maliciousCount} KNOWN-MALICIOUS package advisory(ies) (MAL-…) — treat the build as compromised`));
+		if (typosquats.length) {
+			ui.warn(`${typosquats.length} suspected typosquat(s) — heuristic, verify each is intentional:`);
+			for (const t of typosquats.slice(0, 15)) console.log("    " + chalk.yellow(t.name) + chalk.dim(` (${t.ecosystem}) ≈ ${t.resembles}`));
+			if (typosquats.length > 15) console.log(chalk.dim(`    …and ${typosquats.length - 15} more (see JSON export)`));
+		}
+	}
+
 	// Split prod vs dev based on the dep's isDev flag (set at collection time
 	// from Maven scope=test/provided and npm dev/devOptional/optional). Keep the
 	// full per-bucket list (including cpeFiltered) so the HTML report can render
@@ -1253,7 +1294,7 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		try {
 			const { writeFindings } = require("./lib/json-export");
 			await ensureDir(out.json);
-			writeFindings({ cveMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps: resolved, projectInfo, toolVersion: pkg.version }, out.json);
+			writeFindings({ cveMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps: resolved, projectInfo, toolVersion: pkg.version, typosquats }, out.json);
 			wrote.push(["Findings JSON", out.json]);
 		} catch (err) { ui.warn(`JSON export failed: ${err.message}`); }
 	}
@@ -1280,9 +1321,12 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		const { evaluateGate } = require("./lib/gate");
 		// Embedded-binary findings are real production risk → gate on them too.
 		const gate = evaluateGate([...prodActive, ...embeddedActive], options.failOn);
-		if (gate.failed) {
+		// A known-malicious package always blocks, regardless of the --fail-on level.
+		const maliciousActive = [...prodActive, ...embeddedActive].filter(m => m.malicious);
+		if (gate.failed || maliciousActive.length) {
 			ui.section("Gate");
-			console.log(chalk.red(`✗ --fail-on ${options.failOn}: ${gate.reason}`));
+			if (maliciousActive.length) console.log(chalk.red.bold(`✗ ${maliciousActive.length} known-malicious package(s) detected — always blocks`));
+			if (gate.failed) console.log(chalk.red(`✗ --fail-on ${options.failOn}: ${gate.reason}`));
 			process.exitCode = 1;
 		} else if (verbose) {
 			ui.info(chalk.dim(`--fail-on ${options.failOn}: no blocking finding`));

package/lib/core.js

@@ -312,11 +312,33 @@ async function rewritePoms(pomPath, allPomMetadata, allPropsByPom, opts) {
 		if (!keep.has(k)) delete props[k];
 	}
 
+	// Interpolate ${…} in coordinates against THIS pom's resolved props (incl. the
+	// project.* built-ins via getAllInheritedProps' localVars). A reactor sibling dep
+	// declared <groupId>${project.groupId}</groupId> must resolve to the real groupId for
+	// the byId/local-module lookup + the "missing/private" classification below — otherwise
+	// it's wrongly reported as a private lib (e.g. "${project.groupId}:cnaps-core"). The
+	// dep NODE itself is left raw, so the rewritten cleaned POM keeps ${…} for Snyk's mvn.
+	const pomProps = (allPropsByPom && allPropsByPom[pomPath] && allPropsByPom[pomPath].properties) || {};
+	const interp = (s) => {
+		if (s == null) return s;
+		let out = String(s);
+		for (let i = 0; i < 10 && out.includes("${"); i++) {
+			const next = out.replace(/\$\{\s*([\w.\-]+)\s*\}/g, (m, k) => {
+				const val = pomProps[k];
+				if (val == null) return m;
+				return Array.isArray(val) ? String(val[0]) : String(val);
+			});
+			if (next === out) break;
+			out = next;
+		}
+		return out;
+	};
+
 	const cleanDeps = list =>
 		list?.filter(dep => {
-			const g = coord(dep.groupId?.[0]);
-			const a = coord(dep.artifactId?.[0]);
-			const v = coord(dep.version?.[0]);
+			const g = interp(coord(dep.groupId?.[0]));
+			const a = interp(coord(dep.artifactId?.[0]));
+			const v = interp(coord(dep.version?.[0]));
 			if (!g || !a) return false;
 			if (deps2Exclude) {
 				// Versionless deps inside dependencyManagement-merged result are

package/lib/cve-match.js

@@ -49,11 +49,18 @@ function collectResolvedDeps(allPomMetadata, allPropsByPom, opts = {}) {
 	const collectFrom = (depList, pomPath, props) => {
 		if (!depList) return;
 		for (const dep of depList) {
-			const g = coord(dep.groupId?.[0]);
-			const a = coord(dep.artifactId?.[0]);
+			let g = coord(dep.groupId?.[0]);
+			let a = coord(dep.artifactId?.[0]);
 			let v = coord(dep.version?.[0]);
 			const scope = dep.scope?.[0] || "compile";
 			if (!g || !a) continue;
+			// Interpolate ${…} in the COORDINATE too, not just the version. Reactor sibling
+			// deps routinely use ${project.groupId}/${project.artifactId} (Maven built-ins,
+			// already in `props` via core.js localVars) — without this they'd enter the scan
+			// set as a literal "${project.groupId}:…" coord. Resolve BEFORE the exclude test
+			// so `-e` matches the real groupId.
+			g = resolveDepVersion(g, props);
+			a = resolveDepVersion(a, props);
 			if (ignoreTest && scope === "test") continue;
 			if (deps2Exclude && deps2Exclude.test(g)) continue;
 			if (v) v = resolveDepVersion(v, props);

package/lib/json-export.js

@@ -49,6 +49,7 @@ function cveFinding(m) {
 		fixVersion: c.fixVersion || null,
 		source: m.source || null,
 		confidence: m.confidence || null,
+		malicious: !!m.malicious,
 		cpeFiltered: !!m.cpeFiltered,
 		suppressed: !!m.suppressed,
 		suppressedReason: m.suppressedReason || null,
@@ -67,6 +68,7 @@ function buildFindings(payload = {}) {
 	const {
 		cveMatches = [], retireMatches = [], vendoredJsInventory = [], eolResults = [], obsoleteResults = [],
 		outdatedResults = [], licenseResults = null, resolvedDeps, projectInfo = {}, toolVersion = "0",
+		typosquats = [],
 	} = payload;
 
 	const { buildInventory } = require("./unmanaged");
@@ -101,6 +103,8 @@ function buildFindings(payload = {}) {
 			embedded: embedded.length,
 			vendoredJs: vendoredJsInventory.length,
 			suppressed: cveMatches.filter(m => m.suppressed).length,
+			malicious: cveMatches.filter(m => m.malicious && !m.suppressed).length,
+			typosquat: typosquats.length,
 		},
 		cve: cveMatches.map(cveFinding),
 		vendored: retireMatches.map(cveFinding),
@@ -111,6 +115,7 @@ function buildFindings(payload = {}) {
 		unmanaged,
 		embedded,
 		vendoredJs: vendoredJsInventory,
+		typosquat: typosquats,
 	};
 }
 

package/lib/malware.js

@@ -0,0 +1,100 @@
+/**
+ * lib/malware.js — supply-chain risk lane: known-malicious advisories + typosquat
+ * heuristic. Pure + fully offline (no extra network; data/popular-packages.json is bundled).
+ *
+ * Two distinct signals:
+ *   1. flagMalicious(matches) — PRECISE. Marks any match whose advisory is a known
+ *      malicious-package report (OSV `MAL-…` id/alias, or a `malicious` database flag)
+ *      as malicious. These already flow into the match set via OSV / the local OSV DB;
+ *      this just recognises and elevates them (gate hard-fails on them, like KEV).
+ *   2. detectTyposquats(resolvedDeps) — PROACTIVE / heuristic. Flags an npm or PyPI
+ *      dependency whose name is edit-distance 1 from a well-known popular package (but
+ *      isn't it) — the classic typosquat / "slopsquat" pattern (reqeusts, lodahs, …),
+ *      which no vuln DB catches until after the fact. Conservative (distance 1, length
+ *      ≥ 5, non-scoped) to bound false positives; opt-in via --typosquat.
+ */
+const fs = require("fs");
+const path = require("path");
+
+/**
+ * Damerau-Levenshtein (optimal string alignment) distance, bounded by `max`.
+ * Counts an ADJACENT TRANSPOSITION as 1 — the dominant typosquat pattern (lodahs↔lodash,
+ * reqeusts↔requests) that plain Levenshtein would score as 2. Returns max+1 when the
+ * length gap alone already exceeds the budget. Package names are short, so the full
+ * matrix is cheap; the length prefilter handles the obvious skips.
+ */
+function editDistance(a, b, max) {
+	if (a === b) return 0;
+	const la = a.length, lb = b.length;
+	if (Math.abs(la - lb) > max) return max + 1;
+	const d = Array.from({ length: la + 1 }, () => new Array(lb + 1).fill(0));
+	for (let i = 0; i <= la; i++) d[i][0] = i;
+	for (let j = 0; j <= lb; j++) d[0][j] = j;
+	for (let i = 1; i <= la; i++) {
+		for (let j = 1; j <= lb; j++) {
+			const cost = a.charCodeAt(i - 1) === b.charCodeAt(j - 1) ? 0 : 1;
+			let v = Math.min(d[i - 1][j] + 1, d[i][j - 1] + 1, d[i - 1][j - 1] + cost);
+			if (i > 1 && j > 1 && a.charCodeAt(i - 1) === b.charCodeAt(j - 2) && a.charCodeAt(i - 2) === b.charCodeAt(j - 1)) {
+				v = Math.min(v, d[i - 2][j - 2] + 1); // adjacent transposition
+			}
+			d[i][j] = v;
+		}
+	}
+	return d[la][lb] <= max ? d[la][lb] : max + 1;
+}
+
+let _popular = null;
+function loadPopular(file = path.join(__dirname, "..", "data", "popular-packages.json")) {
+	if (_popular) return _popular;
+	try {
+		const j = JSON.parse(fs.readFileSync(file, "utf8"));
+		// PyPI names normalised per PEP 503 (lowercase, fold -/_/.) — same rule the matcher applies.
+		_popular = { npm: new Set(j.npm || []), pypi: new Set((j.pypi || []).map(s => s.toLowerCase().replace(/[-_.]+/g, "-"))) };
+	} catch { _popular = { npm: new Set(), pypi: new Set() }; }
+	return _popular;
+}
+
+/** Mark matches that are known-malicious advisories. Mutates + returns the count. */
+function flagMalicious(matches) {
+	let n = 0;
+	for (const m of matches || []) {
+		const id = String(m.cve?.id || "");
+		const aliases = m.cve?.aliases || [];
+		const isMal = id.startsWith("MAL-") || aliases.some(a => String(a).startsWith("MAL-")) || m.cve?.malicious === true;
+		if (isMal) { m.malicious = true; if (m.cve) m.cve.malicious = true; n++; }
+	}
+	return n;
+}
+
+/**
+ * Heuristic typosquat detection for npm/PyPI deps. Returns
+ * [{ ecosystem, coord, name, resembles, distance }]. PyPI names are normalised
+ * (lowercase, - / _ folded) per PEP 503 before comparison.
+ */
+function detectTyposquats(resolvedDeps, opts = {}) {
+	const popular = opts.popular || loadPopular();
+	const out = [];
+	const norm = (eco, name) => eco === "pypi" ? name.toLowerCase().replace(/[-_.]+/g, "-") : name;
+	for (const dep of resolvedDeps.values()) {
+		const eco = dep.ecosystem;
+		if (eco !== "npm" && eco !== "pypi") continue;
+		if (dep.provenance === "embedded" || dep.provenance === "binary") continue;
+		const rawName = dep.name || dep.artifactId || "";
+		if (!rawName || rawName.startsWith("@")) continue;      // skip scoped npm (namespace-protected)
+		const name = norm(eco, rawName);
+		const set = eco === "npm" ? popular.npm : popular.pypi;
+		if (!set.size || set.has(eco === "pypi" ? name : rawName)) continue; // a popular pkg itself is not a squat
+		if (name.length < 5) continue;                          // too short → noisy
+		let best = null;
+		for (const pop of set) {
+			const target = eco === "pypi" ? pop : pop;          // pypi set already normalised at load
+			if (Math.abs(target.length - name.length) > 1) continue;
+			const d = editDistance(name, target, 1);
+			if (d === 1) { best = target; break; }
+		}
+		if (best) out.push({ ecosystem: eco, coord: dep.coordKey || rawName, name: rawName, resembles: best, distance: 1 });
+	}
+	return out;
+}
+
+module.exports = { flagMalicious, detectTyposquats, editDistance, loadPopular };

package/lib/osv-db.js

@@ -0,0 +1,160 @@
+/**
+ * lib/osv-db.js — offline-COMPLETE OSV matching from a locally imported OSV database
+ * (the per-ecosystem `all.zip` exports OSV.dev publishes on its public GCS bucket).
+ *
+ * Why this exists alongside lib/osv.js: the latter queries the OSV.dev API *per
+ * dependency* and caches each response (12 h TTL). Offline, that only covers the deps
+ * that happened to be queried online before — a cold dep has NO OSV data. This module
+ * imports the FULL OSV database once while online (Maven = 9 MB zip, ~6.6 k advisories)
+ * and matches EVERY dep against it offline, deterministically, regardless of the per-dep
+ * cache. That is exactly the model OSV-Scanner uses for air-gapped scans
+ * (`--download-offline-databases`), and it makes fad's offline Maven recall complete and
+ * cache-independent for a PASSI engagement.
+ *
+ * Maven only for now: range matching needs the ecosystem's version ordering, and fad has
+ * a robust Maven comparator (lib/maven-version). npm/PyPI/etc. are a documented follow-up
+ * (they need semver/PEP-440 ordering). The OSV records are full OSV-schema vuln objects —
+ * identical to the API — so lib/osv.js#vulnToMatch is reused verbatim.
+ *
+ * Online (download+index) + cached (~/.fad-checker/osv-db, 24 h) + offline-aware (loads a
+ * present index, never blocks). The index travels in the cache archive automatically.
+ */
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+const { unzipSync } = require("fflate");
+const { compareMavenVersions } = require("./maven-version");
+const { vulnToMatch } = require("./osv");
+
+const OSV_DB_DIR = path.join(os.homedir(), ".fad-checker", "osv-db");
+const BUCKET = "https://osv-vulnerabilities.storage.googleapis.com";
+const TTL_MS = 24 * 3600 * 1000;
+// OSV ecosystem export name per fad codec id. Maven only for now (version ordering).
+const ECO = { maven: "Maven" };
+const indexPath = eco => path.join(OSV_DB_DIR, `${eco}-index.json`);
+
+/** Keep only what vulnToMatch + matching need, so the cached index stays compact. */
+function trimVuln(vuln, affForPkg) {
+	return {
+		id: vuln.id,
+		aliases: vuln.aliases || [],
+		summary: vuln.summary || "",
+		details: (vuln.details || "").slice(0, 2000),
+		severity: vuln.severity || [],
+		...(vuln.database_specific?.severity ? { database_specific: { severity: vuln.database_specific.severity } } : {}),
+		references: (vuln.references || []).slice(0, 20),
+		published: vuln.published || null,
+		modified: vuln.modified || null,
+		affected: affForPkg.map(a => ({ package: a.package, ranges: a.ranges || [], versions: a.versions || [] })),
+	};
+}
+
+/** Build { byPackage: { "g:a"(lower): [trimmedVuln] }, … } from an all.zip buffer. */
+function buildIndexFromZip(buf, ecosystemName) {
+	const files = unzipSync(new Uint8Array(buf));
+	const dec = new TextDecoder();
+	const byPackage = {};
+	let count = 0;
+	for (const name of Object.keys(files)) {
+		let vuln;
+		try { vuln = JSON.parse(dec.decode(files[name])); } catch { continue; }
+		if (!vuln || vuln.withdrawn) continue;
+		// A vuln can list several packages; index it under each (with that package's affected slice).
+		const byPkg = new Map();
+		for (const a of (vuln.affected || [])) {
+			if (a.package?.ecosystem !== ecosystemName) continue;
+			const nm = a.package?.name;
+			if (!nm) continue;
+			if (!byPkg.has(nm)) byPkg.set(nm, []);
+			byPkg.get(nm).push(a);
+		}
+		for (const [nm, affs] of byPkg) {
+			const key = nm.toLowerCase();
+			(byPackage[key] = byPackage[key] || []).push(trimVuln(vuln, affs));
+			count++;
+		}
+	}
+	return { _builtAt: Date.now(), ecosystem: ecosystemName, count, packages: Object.keys(byPackage).length, byPackage };
+}
+
+/**
+ * Ensure the local OSV DB index for an ecosystem. Downloads + (re)builds when online and
+ * stale/missing; offline (or on any network failure) loads whatever is present, else null.
+ */
+async function ensureOsvDb(opts = {}) {
+	const { offline, refresh, verbose, fetcher = globalThis.fetch, ecosystem = "maven" } = opts;
+	const ecoName = ECO[ecosystem];
+	if (!ecoName) return null;
+	const ip = indexPath(ecosystem);
+	const loadAny = () => { try { return JSON.parse(fs.readFileSync(ip, "utf8")); } catch { return null; } };
+	const loadFresh = () => { const j = loadAny(); return j && (Date.now() - (j._builtAt || 0) < TTL_MS) ? j : null; };
+
+	if (offline) return loadAny();
+	if (!refresh) { const f = loadFresh(); if (f) return f; }
+	try {
+		const res = await fetcher(`${BUCKET}/${ecoName}/all.zip`, { headers: { "User-Agent": "fad-checker-osv-db" } });
+		if (!res || !res.ok) { if (verbose) console.warn(`osv-db: HTTP ${res?.status}`); return loadAny(); }
+		const buf = Buffer.from(await res.arrayBuffer());
+		const index = buildIndexFromZip(buf, ecoName);
+		fs.mkdirSync(OSV_DB_DIR, { recursive: true });
+		fs.writeFileSync(ip, JSON.stringify(index));
+		return index;
+	} catch (e) { if (verbose) console.warn(`osv-db: ${e.message}`); return loadAny(); }
+}
+
+// ---- OSV range evaluation over Maven version ordering ----
+function inInterval(v, intro, upper, inclusive) {
+	if (intro != null && intro !== "0" && compareMavenVersions(v, intro) < 0) return false;
+	const c = compareMavenVersions(v, upper);
+	return inclusive ? c <= 0 : c < 0;
+}
+function rangeAffects(version, range) {
+	if (!range || range.type === "GIT") return false;
+	let intro = null;
+	for (const e of (range.events || [])) {
+		if (e.introduced !== undefined) intro = e.introduced;
+		else if (e.fixed !== undefined) { if (inInterval(version, intro, e.fixed, false)) return true; intro = null; }
+		else if (e.last_affected !== undefined) { if (inInterval(version, intro, e.last_affected, true)) return true; intro = null; }
+	}
+	if (intro !== null) { // open interval [introduced, ∞)
+		if (intro === "0" || compareMavenVersions(version, intro) >= 0) return true;
+	}
+	return false;
+}
+function vulnAffectsVersion(version, trimmedVuln) {
+	for (const a of (trimmedVuln.affected || [])) {
+		if ((a.versions || []).includes(version)) return true;
+		for (const r of (a.ranges || [])) if (rangeAffects(version, r)) return true;
+	}
+	return false;
+}
+
+/**
+ * Match resolved Maven deps against a local OSV DB index. Returns vulnToMatch-shaped
+ * matches (source 'osv'), one per (coord, version, vuln). Scans every distinct version.
+ */
+function matchOsvDbDeps(resolvedDeps, index) {
+	if (!index || !index.byPackage) return [];
+	const out = [];
+	const seen = new Set();
+	for (const dep of resolvedDeps.values()) {
+		if (dep.ecosystem !== "maven") continue;
+		if (dep.provenance === "embedded" || dep.provenance === "binary") continue;
+		const recs = index.byPackage[`${dep.groupId}:${dep.artifactId}`.toLowerCase()];
+		if (!recs || !recs.length) continue;
+		const versions = (dep.versions && dep.versions.length) ? dep.versions : [dep.version];
+		for (const ver of versions) {
+			if (!ver || /\$\{/.test(String(ver))) continue;
+			for (const rec of recs) {
+				if (!vulnAffectsVersion(ver, rec)) continue;
+				const key = `${dep.groupId}:${dep.artifactId}:${ver}|${rec.id}`;
+				if (seen.has(key)) continue;
+				seen.add(key);
+				out.push(vulnToMatch(ver === dep.version ? dep : { ...dep, version: ver }, rec));
+			}
+		}
+	}
+	return out;
+}
+
+module.exports = { ensureOsvDb, buildIndexFromZip, matchOsvDbDeps, rangeAffects, vulnAffectsVersion, OSV_DB_DIR };

package/lib/version-overlay.js

@@ -93,8 +93,9 @@ async function buildModuleManagement(pomPath, store, propsByPom, opts = {}) {
 		if (!entry) continue;
 		const props = entry.properties || {};
 		for (const node of entry.dependencyManagement || []) {
-			const g = coord(node.groupId?.[0]);
-			const a = coord(node.artifactId?.[0]);
+			// Interpolate ${…} in the coordinate (e.g. ${project.groupId}) like the version.
+			const g = resolveDepVersion(coord(node.groupId?.[0]), props);
+			const a = resolveDepVersion(coord(node.artifactId?.[0]), props);
 			if (!g || !a) continue;
 			const v = resolveDepVersion(coord(node.version?.[0]), props);
 			if (node.scope?.[0] === "import") {
@@ -134,10 +135,13 @@ function buildModuleDirects(pomPath, propsByPom, moduleMgmt, resolvedDeps, opts
 		if (!d || !d.groupId || !d.artifactId || d.optional || d.isImport) continue;
 		if (d.scope === "test" && !opts.includeTestDeps) continue;
 		if (d.scope === "system" || d.scope === "import") continue;
+		// Interpolate ${…} in the coordinate (e.g. ${project.groupId}) like the version.
+		const gid = resolveDepVersion(d.groupId, props);
+		const aid = resolveDepVersion(d.artifactId, props);
 		let v = resolveDepVersion(d.rawVersion, props);
-		if (!isConcrete(v)) v = moduleMgmt.get(`${d.groupId}:${d.artifactId}`) || resolvedDeps.get(`${d.groupId}:${d.artifactId}`)?.version || null;
+		if (!isConcrete(v)) v = moduleMgmt.get(`${gid}:${aid}`) || resolvedDeps.get(`${gid}:${aid}`)?.version || null;
 		if (!isConcrete(v)) continue;
-		out.push({ groupId: d.groupId, artifactId: d.artifactId, version: String(v), scope: d.scope, exclusions: d.exclusions });
+		out.push({ groupId: gid, artifactId: aid, version: String(v), scope: d.scope, exclusions: d.exclusions });
 	}
 	return out;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fad-checker",
-  "version": "2.2.2",
+  "version": "2.2.3",
   "description": "Scan ALL Maven, npm, Yarn, Composer, Python, C#/.NET, Go & Ruby dependencies — plus embedded JARs (fat-jars/war/ear) — in a source tree ONE SHOT without mvn/python/etc — CVE (EPSS/KEV-prioritised), EOL, obsolete, outdated & licenses, with SBOM/CSAF/SARIF/JSON exports, CI gating and fix recos",
   "keywords": [
     "sca",