fad-checker 2.2.4 → 2.3.1

package/lib/cpe.js

@@ -147,6 +147,31 @@ function nodeAffectsDep(node, dep, cpeCoordMap) {
 	return false;
 }
 
+/**
+ * Does ANY vulnerable cpeMatch in this CVE name the dep's product/vendor — IGNORING the
+ * version range? This distinguishes "NVD has a CPE for this product but the dep version is
+ * out of range" (a genuine false positive worth filtering) from "NVD's CPE never names this
+ * product at all" (a coverage gap — NOT a false positive: the dep's own matcher, OSV or the
+ * CVE index, found it on a real coordinate, and CPE simply can't speak to it).
+ */
+function cveCpeNamesDep(cveRecord, dep, cpeCoordMap) {
+	const map = cpeCoordMap || loadCpeCoordMap();
+	const scan = nodes => {
+		for (const n of (nodes || [])) {
+			for (const m of (n.cpeMatch || n.cpe_match || [])) {
+				if (m.vulnerable === false) continue;
+				const parsed = parseCpe23Cached(m);
+				if (parsed && cpeMatchesDep(parsed, dep, map)) return true;
+			}
+			if (Array.isArray(n.children) && scan(n.children)) return true;
+		}
+		return false;
+	};
+	for (const cfg of (cveRecord?.configurations || [])) if (scan(cfg.nodes)) return true;
+	for (const uri of (cveRecord?.cpes || [])) { const p = parseCpe23(uri); if (p && cpeMatchesDep(p, dep, map)) return true; }
+	return false;
+}
+
 /**
  * A node is "context-only" when it carries no vulnerable cpeMatch (recursively) —
  * e.g. the "…AND runs on linux_kernel" platform node, whose CPEs are all
@@ -309,8 +334,19 @@ function refineMatchesWithCpe(matches, opts = {}) {
 		if (!rec.configurations.length && !rec.cpes.length) continue;
 		const { affected, confidence } = evaluateCveForDep(rec, m.dep, map);
 		m.cpeConfidence = confidence;
-		if (!affected && rec.configurations.length) {
-			// Configurations exist but version doesn't satisfy any → likely FP
+		// Mark a match as a CPE false-positive ONLY for a genuine VERSION contradiction:
+		// NVD's CPE names this product but the dep version is outside the vulnerable range.
+		// NEVER filter when:
+		//   - the match is OSV-confirmed — OSV did a precise, ecosystem-native version match
+		//     (its data is authoritative for the package ecosystems; don't let NVD override it);
+		//   - NVD's CPE never names this product (`!productNamed`) — that's a coverage gap, not
+		//     a false positive (covers every pypi/composer/nuget/go/ruby coord, and any maven/
+		//     npm artifact whose CPE product name simply differs from its coordinate).
+		// Without these guards the filter silently hid REAL CVEs (e.g. cryptography 46.0.5,
+		// fixed in 46.0.6) by dumping them into the false-positives appendix.
+		const isOsv = String(m.source || "").includes("osv");
+		const productNamed = cveCpeNamesDep(rec, m.dep, map);
+		if (!affected && productNamed && !isOsv) {
 			m.cpeFiltered = true;
 		}
 		if (affected && confidence === "exact" && m.confidence !== "exact") m.confidence = "exact";
@@ -325,6 +361,7 @@ module.exports = {
 	cpeMatchesDep,
 	nodeAffectsDep,
 	evaluateCveForDep,
+	cveCpeNamesDep,
 	refineMatchesWithCpe,
 	loadCpeCoordMap,
 };

package/lib/cve-match.js

@@ -122,6 +122,19 @@ function collectResolvedDeps(allPomMetadata, allPropsByPom, opts = {}) {
  *     for transitive deps. This mirrors Maven's behaviour where the root
  *     project's <dependencyManagement> wins over transitive depMgmt.
  */
+/**
+ * A transitive coord is itself a Maven artifact (ecosystem "maven"), but for REPORT
+ * grouping we attribute its ecosystemType to the build tool that pulled it in: if every
+ * root reaching it (the first node of each via-chain) is a Gradle direct dep, it belongs
+ * in the Gradle chapter; a Maven (or mixed/unknown) root keeps it in the Maven chapter.
+ * @param viaPaths array of chains [[rootCoord, …], …]; @param rootEcoType Map coordKey→type
+ */
+function inheritEcoType(viaPaths, rootEcoType) {
+	const roots = (viaPaths || []).map(p => p && p[0]).filter(Boolean);
+	const types = new Set(roots.map(r => rootEcoType.get(r)).filter(Boolean));
+	return (types.size === 1 && types.has("gradle")) ? "gradle" : "maven";
+}
+
 async function expandWithTransitives(resolvedDeps, opts = {}) {
 	const { verbose } = opts;
 	// Root depMgmt: every dep in the Map that has a concrete version becomes a
@@ -146,6 +159,11 @@ async function expandWithTransitives(resolvedDeps, opts = {}) {
 
 	if (verbose) console.log(`🌳 Resolving transitives for ${directs.length} direct deps…`);
 
+	// Root → ecosystemType, so a transitive pulled only by Gradle roots is reported in the
+	// Gradle chapter (not the Maven one) on a pure-Gradle project.
+	const rootEcoType = new Map();
+	for (const d of directs) rootEcoType.set(`${d.groupId}:${d.artifactId}`, d.ecosystemType || d.ecosystem || "maven");
+
 	const transitives = await resolveTransitiveDeps(directs, {
 		...opts,
 		rootDepMgmt,
@@ -165,7 +183,7 @@ async function expandWithTransitives(resolvedDeps, opts = {}) {
 			viaPaths: t.viaPaths || [t.via],
 			depth: t.depth,
 			ecosystem: "maven",
-			ecosystemType: "maven",
+			ecosystemType: inheritEcoType(t.viaPaths || [t.via], rootEcoType),
 		});
 		added++;
 	}
@@ -281,6 +299,7 @@ function matchDepsAgainstCves(resolvedDeps, cveIndex, opts = {}) {
 module.exports = {
 	collectResolvedDeps,
 	expandWithTransitives,
+	inheritEcoType,
 	matchDepsAgainstCves,
 	resolveDepVersion,
 	vendorMatchesGroup,

package/lib/cve-report.js

@@ -418,6 +418,53 @@ function makeRelative(absPath, srcRoot) {
 	} catch { return absPath; }
 }
 
+// Inventory of the manifest/lockfile descriptors fad actually parsed and fed into the
+// scan: the union of every declared dep's manifestPaths (relative to the src root), with
+// the ecosystem(s) and the count of direct deps each contributed. Transitive deps (resolved
+// from a registry, no local file) and committed binaries (embedded/native — inventoried in
+// chapters 1B/1C, not "descriptors") are excluded.
+function buildScannedManifests(resolvedDeps, srcRoot, parsedManifests = []) {
+	const byPath = new Map();
+	const touch = (relPath, eco) => {
+		let e = byPath.get(relPath);
+		if (!e) { e = { path: relPath, ecosystems: new Set(), count: 0 }; byPath.set(relPath, e); }
+		if (eco) e.ecosystems.add(eco);
+		return e;
+	};
+	// Files that contributed at least one scanned dependency (count = direct deps).
+	for (const dep of (resolvedDeps?.values?.() || [])) {
+		if (dep.scope === "transitive") continue;
+		if (dep.provenance === "embedded" || dep.provenance === "binary") continue;
+		const paths = (dep.manifestPaths && dep.manifestPaths.length) ? dep.manifestPaths
+			: (dep.pomPaths && dep.pomPaths.length) ? dep.pomPaths : [];
+		for (const p of paths) touch(makeRelative(p, srcRoot), dep.ecosystemType || dep.ecosystem || "?").count++;
+	}
+	// EVERY descriptor each codec reported parsing — incl. ones that contributed nothing
+	// (ranges-only / no lockfile). These land with count 0 so nothing is silently omitted.
+	for (const pm of (parsedManifests || [])) {
+		if (!pm || !pm.path) continue;
+		touch(makeRelative(pm.path, srcRoot), pm.ecosystemType);
+	}
+	return [...byPath.values()]
+		.map(e => ({ path: e.path, ecosystems: [...e.ecosystems].sort(), count: e.count }))
+		.sort((a, b) => a.path.localeCompare(b.path));
+}
+
+function renderScannedManifests(list) {
+	if (!list.length) return `<div class="empty">No dependency descriptors were parsed (deps came only from registries or committed binaries).</div>`;
+	const emptyN = list.filter(e => e.count === 0).length;
+	const intro = `<div class="fp-intro">Every manifest / lockfile descriptor fad-checker parsed for this scan (paths relative to the source root) — the complete list, including files that contributed <strong>no scannable dependency</strong> (only version ranges, or no lockfile)${emptyN ? `: ${emptyN} such file${emptyN > 1 ? "s" : ""} shown with <code>0</code>` : ""}. Transitive deps resolved from registries, and committed binaries (chapters 1B/1C), are not descriptors and are excluded here.</div>`;
+	const rows = list.map(e => `<tr>
+		<td class="dep"><code>${esc(e.path)}</code></td>
+		<td>${esc(e.ecosystems.map(x => ECO_LABELS[x] || x).join(", "))}</td>
+		<td>${e.count > 0 ? e.count : `<span style="color:#9ca3af">0 <span style="font-style:italic">— ranges / no lockfile</span></span>`}</td>
+	</tr>`).join("\n");
+	return intro + `<table>
+		<thead><tr><th>Descriptor</th><th>Ecosystem</th><th>Direct deps</th></tr></thead>
+		<tbody>${rows}</tbody>
+	</table>`;
+}
+
 // Présentation des coordonnées, déléguée au codec. Règle générique : le codec
 // fournit la coord canonique (maven "g:a", npm "name", composer "vendor/pkg"…) ;
 // Maven la porte déjà son namespace, les autres reçoivent un tag d'écosystème
@@ -1007,7 +1054,7 @@ function renderObsoleteTable(obs) {
 	if (!obs?.length) return `<div class="empty">No obsolete / deprecated libraries detected.</div>`;
 	const rows = obs.map(o => `<tr>
 		<td>${badge((o.severity || "MEDIUM").toUpperCase())}</td>
-		<td class="dep">${esc(depDisplayName(o.dep))}<br><span style="color:#6b7280">${esc(o.dep.version || "?")}</span>${renderDefinedIn(o.dep, RENDER_CTX.srcRoot)}</td>
+		<td class="dep">${esc(depDisplayName(o.dep))}<br><span style="color:#6b7280">${esc(o.dep.version || "?")}</span>${renderDepOrigin(o.dep, RENDER_CTX.srcRoot)}</td>
 		<td class="dep">${esc(o.replacement || "—")}</td>
 		<td class="desc">${esc(o.reason || "")}</td>
 	</tr>`).join("\n");
@@ -1141,7 +1188,7 @@ function minorSection(title, contentHtml, opts = {}) {
 }
 
 const WARNING_HEADINGS = {
-	"no-lockfile":            { icon: "⚠️", title: "JS manifest without lockfile" },
+	"no-lockfile":            { icon: "⚠️", title: "Manifest without a lockfile — best-effort (ranges skipped)" },
 	"yarn-berry-unsupported": { icon: "⚠️", title: "Yarn 2+/Berry lockfile" },
 	"unresolved-versions":    { icon: "⚠️", title: "Maven deps without a concrete version — silently skipped, run a real Maven/Snyk scan to complete" },
 	"private-libs":           { icon: "🔒", title: "Private / internal libraries — not on Maven Central, not scanned" },
@@ -1438,7 +1485,7 @@ function renderLicenseChapter(licenseResults) {
 	return intro + blocks;
 }
 
-function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings, wrapTables = true }) {
+function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings, parsedManifests = [], wrapTables = true }) {
 	setRenderCtx({ srcRoot: projectInfo?.src || null });
 	// Dedupe rows so a single (dep, cve) shows once with all via paths merged.
 	cveMatches      = mergeMatches(cveMatches || []);
@@ -1504,9 +1551,11 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 	// (C) Table of contents — rendered as a sticky nav. Only enumerates the
 	// chapters that actually have content (warnings, dev CVE, retire, FP appendix
 	// might be empty).
+	const scanned = buildScannedManifests(resolvedDeps, projectInfo?.src, parsedManifests);
 	const toc = renderToc({
 		hasWarnings: !!(warnings?.length),
 		prodTotal: prodStats.total,
+		scannedTotal: scanned.length,
 		retireTotal: retireMatches.length,
 		devTotal: devStats.total,
 		eolTotal: eolResults?.length || 0,
@@ -1528,7 +1577,7 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 			<h1>FAD-Checker Report</h1>
 			<div class="report-subtitle">Multi-ecosystem dependency security audit</div>
 			<div class="meta">
-				Project: <strong>${esc(projectInfo.name)}</strong> · <code class="path">${esc(projectInfo.src)}</code><br>
+				Project: <strong>${esc(projectInfo.name)}</strong><br>
 				Generated: ${esc(projectInfo.generatedAt)}${projectInfo.toolVersion ? ` · fad-checker ${esc(projectInfo.toolVersion)}` : ""}${projectInfo.cveDataDate ? ` · CVE data: ${esc(projectInfo.cveDataDate)}` : ""}
 			</div>
 		</header>
@@ -1551,6 +1600,7 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 		${majorSection(`7. Licenses (${licenseTotal}${licenseFlagged ? `, ${licenseFlagged} to review` : ""})`, licenseContent, { open: licenseFlagged > 0, id: "ch7" })}
 		${majorSection(`8. Fix Recommendations`, renderFixRecommendations(recos, prodMatchesActive, outdatedResults), { open: false, id: "ch8" })}
 		${(prodMatchesFP.length + devMatchesFP.length + embMatchesFP.length) ? majorSection(`9. Appendix: Likely false positives (CPE-filtered) (${prodMatchesFP.length + devMatchesFP.length + embMatchesFP.length})`, fpContent, { open: false, id: "ch9" }) : ""}
+		${majorSection(`10. Appendix: Scanned dependency descriptors (${scanned.length})`, renderScannedManifests(scanned), { open: false, id: "chsrc" })}
 	`;
 	return wrapTables ? wrapTablesWithCopyButtons(body) : body;
 }
@@ -1614,7 +1664,7 @@ function pickTopEol(eolResults, n) {
 	}).slice(0, n);
 }
 
-function renderToc({ hasWarnings, prodTotal, embeddedTotal, unmanagedTotal, vendoredJsTotal, retireTotal, devTotal, eolTotal, obsoleteTotal, outdatedTotal, licenseTotal, licenseFlagged, fpTotal }) {
+function renderToc({ hasWarnings, prodTotal, embeddedTotal, unmanagedTotal, vendoredJsTotal, retireTotal, devTotal, eolTotal, obsoleteTotal, outdatedTotal, licenseTotal, licenseFlagged, fpTotal, scannedTotal }) {
 	const entries = [];
 	if (hasWarnings)                  entries.push({ id: "ch0", label: "0. Warnings" });
 	entries.push({ id: "ch1", label: `1. Prod CVE (${prodTotal})` });
@@ -1629,6 +1679,7 @@ function renderToc({ hasWarnings, prodTotal, embeddedTotal, unmanagedTotal, vend
 	entries.push({ id: "ch7", label: `7. Licenses (${licenseTotal || 0}${licenseFlagged ? `, ${licenseFlagged}⚠` : ""})` });
 	entries.push({ id: "ch8", label: `8. Fix Recos` });
 	if (fpTotal)                      entries.push({ id: "ch9", label: `9. Likely FP (${fpTotal})` });
+	entries.push({ id: "chsrc", label: `10. Scanned descriptors (${scannedTotal || 0})` });
 	return `<nav class="toc">${entries.map(e => `<a href="#${e.id}">${esc(e.label)}</a>`).join("")}</nav>`;
 }
 
@@ -2169,12 +2220,12 @@ ${WORD_SECTION_PR}
 // Render the HTML and/or Word report. Callers pass explicit target paths;
 // a null/omitted path skips that format (so `--report-html` alone writes only HTML).
 // Back-compat: `outputDir` still writes both under the default file names.
-async function writeReports({ cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, outputDir, htmlPath, docPath, warnings }) {
+async function writeReports({ cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, outputDir, htmlPath, docPath, warnings, parsedManifests }) {
 	if (outputDir) {
 		if (htmlPath === undefined) htmlPath = path.join(outputDir, "cve-report.html");
 		if (docPath === undefined) docPath = path.join(outputDir, "cve-report.doc");
 	}
-	const payload = { cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings };
+	const payload = { cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps, projectInfo, warnings, parsedManifests };
 	const written = { htmlPath: null, docPath: null };
 	if (htmlPath) {
 		await fs.promises.mkdir(path.dirname(path.resolve(htmlPath)), { recursive: true });

package/lib/deps-descriptor.js

@@ -1,6 +1,6 @@
 /**
  * lib/deps-descriptor.js — serialize / deserialize an *anonymized* descriptor of
- * the resolved dependency set, for PASSI-style offline→online→offline audits.
+ * the resolved dependency set, for air-gapped offline→online→offline audits.
  *
  * Phase 1 (offline): collect deps → serializeDeps → write JSON. No paths, URLs,
  *   hostnames or usernames leave the air-gapped machine — only public package
@@ -10,7 +10,7 @@
  * Phase 3 (offline): `--import-cache` + a normal `--offline` scan re-collects the
  *   source locally (real paths) and gets cache hits → full detailed report.
  *
- * See docs/superpowers/specs/2026-05-30-anonymized-deps-descriptor-passi-design.md
+ * See the anonymized-deps-descriptor design spec.
  *
  * Pure functions: no I/O, no console. The caller does file read/write.
  *

package/lib/osv-db.js

@@ -9,7 +9,7 @@
  * and matches EVERY dep against it offline, deterministically, regardless of the per-dep
  * cache. That is exactly the model OSV-Scanner uses for air-gapped scans
  * (`--download-offline-databases`), and it makes fad's offline Maven recall complete and
- * cache-independent for a PASSI engagement.
+ * cache-independent for an air-gapped engagement.
  *
  * Maven only for now: range matching needs the ecosystem's version ordering, and fad has
  * a robust Maven comparator (lib/maven-version). npm/PyPI/etc. are a documented follow-up

package/lib/osv.js

@@ -121,18 +121,32 @@ function severityFromOsv(vuln) {
 
 function scoreFromVuln(vuln) { return cvssInfoFromVuln(vuln).score; }
 
-/** Extract the first fix version from OSV affected ranges (semver/ecosystem events). */
-function fixVersionFromOsv(vuln, depKey) {
+/**
+ * Pick the fix version to recommend from OSV's affected ranges. A multi-branch advisory
+ * (e.g. Tomcat fixed in 9.0.118, 10.1.55 AND 11.0.22) lists one `fixed` per branch — the
+ * old code returned the FIRST, which for an 11.0.21 dep meant "upgrade to 9.0.118", i.e. a
+ * DOWNGRADE. Instead pick the smallest fix strictly ABOVE the current version: that's the
+ * next patched release on the dep's own branch. If none is greater (the branch has no
+ * published fix, or the dep is already patched), return null rather than suggest a downgrade.
+ */
+function fixVersionFromOsv(vuln, depKey, depVersion) {
+	const { compareMavenVersions } = require("./maven-version");
+	const fixes = [];
 	for (const a of vuln.affected || []) {
 		const name = a.package?.name?.toLowerCase();
 		if (name && name !== depKey.toLowerCase()) continue;
 		for (const r of a.ranges || []) {
 			for (const ev of r.events || []) {
-				if (ev.fixed) return ev.fixed;
+				if (ev.fixed) fixes.push(String(ev.fixed));
 			}
 		}
 	}
-	return null;
+	if (!fixes.length) return null;
+	const cmp = (x, y) => { try { return compareMavenVersions(x, y); } catch { return String(x).localeCompare(String(y)); } };
+	const sorted = [...fixes].sort(cmp);
+	if (!depVersion) return sorted[0]; // no current version to compare against → lowest published fix
+	const upgrades = sorted.filter(f => cmp(f, depVersion) > 0);
+	return upgrades.length ? upgrades[0] : null;
 }
 
 /** Pick the best CVE id from an OSV vuln (prefer CVE-* aliases over GHSA-*). */
@@ -188,7 +202,7 @@ function vulnToMatch(dep, vuln) {
 			...(cvss.version ? { cvssVersion: `CVSS:${cvss.version}` } : {}),
 			description,
 			summary,
-			fixVersion: fixVersionFromOsv(vuln, osvPkgName(dep)),
+			fixVersion: fixVersionFromOsv(vuln, osvPkgName(dep), dep.version),
 			ghsa: (vuln.aliases || []).find(a => a.startsWith("GHSA-")) || (vuln.id?.startsWith("GHSA-") ? vuln.id : null),
 			published: vuln.published || null,
 			modified: vuln.modified || null,

package/lib/retire.js

@@ -29,7 +29,7 @@ const RETIRE_CACHE_TTL_MS = 24 * 3600 * 1000;
 
 // retire's own signature DB. By default retire caches it in /tmp/.retire-cache
 // (outside ~/.fad-checker/, with a 1h TTL → a network refetch on expiry). For the
-// PASSI offline workflow we instead keep a stable local copy INSIDE ~/.fad-checker/
+// air-gapped offline workflow we instead keep a stable local copy INSIDE ~/.fad-checker/
 // so `--export-cache` carries it, and feed it to retire via `--jsrepo <file>`
 // (loaded from file, never the network — no TTL).
 const RETIRE_SIG_DIR = path.join(os.homedir(), ".fad-checker", "retire-signatures");

package/lib/sarif-export.js

@@ -116,7 +116,7 @@ function buildSarif(matches, opts = {}) {
 				driver: {
 					name: "fad-checker",
 					version: String(toolVersion),
-					informationUri: "https://github.com/n8tz/fad-checker",
+					informationUri: "https://github.com/9pings/fad-checker",
 					rules: [...rulesById.values()],
 				},
 			},

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fad-checker",
-  "version": "2.2.4",
-  "description": "Scan ALL Maven, npm, Yarn, Composer, Python, C#/.NET, Go & Ruby dependencies — plus embedded JARs (fat-jars/war/ear) — in a source tree ONE SHOT without mvn/python/etc — CVE (EPSS/KEV-prioritised), EOL, obsolete, outdated & licenses, with SBOM/CSAF/SARIF/JSON exports, CI gating and fix recos",
+  "version": "2.3.1",
+  "description": "Scan ALL Maven, Gradle, npm, Yarn, Composer, Python, C#/.NET, Go & Ruby dependencies — plus embedded JARs (fat-jars/war/ear) — in a source tree ONE SHOT without mvn/python/etc — CVE (EPSS/KEV-prioritised), EOL, obsolete, outdated & licenses, with SBOM/CSAF/SARIF/JSON exports, CI gating and fix recos",
   "keywords": [
     "sca",
     "software-composition-analysis",
@@ -29,7 +29,6 @@
     "supply-chain",
     "offline",
     "air-gapped",
-    "passi",
     "maven",
     "npm",
     "yarn",
@@ -46,9 +45,9 @@
     "cli"
   ],
   "license": "MIT",
-  "repository": "https://github.com/n8tz/fad-checker",
-  "homepage": "https://github.com/n8tz/fad-checker#readme",
-  "bugs": "https://github.com/n8tz/fad-checker/issues",
+  "repository": "https://github.com/9pings/fad-checker",
+  "homepage": "https://github.com/9pings/fad-checker#readme",
+  "bugs": "https://github.com/9pings/fad-checker/issues",
   "author": "pp9Ping <pp9Ping@gmail.com>",
   "maintainers": [
     "pp9Ping <pp9Ping@gmail.com>"