[Cesar-M-Diaz]

Three skills claimed NCM data that NCM doesn't return.

• ns-replace-package: it listed "obfuscation, author risk, malware" as NCM module risks. NCM has none of those checks; its only security check is vulnerability. Its risk checks are deprecated, install scripts, gyp file, eval, dynamic require, strict mode, unsafe regexps, deprecated Node APIs, and four async and callback checks. The example now names real ones. The maintenance signal ("latest version age") came from NCM; it now comes from npm (npm view <pkg> version, then npm view <pkg> 'time[<version>]').
• ns-upgrade-package: it said getPackageQuality returns the latest version. A call for the installed version doesn't, and NCM's latest can trail npm by weeks: today it resolves express to 5.2.1, while npm's latest is 5.3.0. The skill now gets it from the npm registry (npm view <pkg> version).
• ns-node-upgrade: the dependency step checked "target-Node incompatibilities if NCM reports them". NCM has no such data. The closest signal is the uses-deprecated-node-apis score, so the step now reads it from allScores (failing checks land in moduleRisks without their name), compares each dependency's engines.node with the target, and says neither is a full compatibility check. Versions come from the lockfile: a package.json range makes npm view <pkg>@<range> engines print every matching version, and a workspace: spec fails the whole getPackageVersions call.

Checks

• pnpm plugin:check: OK.
• pnpm lint, pnpm typecheck, pnpm test: pass.

[ns-control-tower]

Note

Reviewing the latest changes on this PR — this may take a few minutes.
This comment will be updated in place with the findings; no other top-level comments will be posted.

[brycebaril]

Thanks, Cesar. Checked at 96604bc:

• ns-replace-package lists only risk checks NCM has. It takes the latest version and its age from npm. time[<version>] is the right date, since a deprecation or a backport also moves time.modified.
• ns-upgrade-package reads the latest version from npm's latest dist-tag, not from NCM's latest, which can trail it.
• ns-node-upgrade reads uses-deprecated-node-apis from allScores, where the check keeps its name. It takes versions from the lockfile and leaves out the specs that would fail the whole call. It also says neither signal is a full compatibility check.

CI passes on Linux, macOS and Windows. It targets main, like #76, so the released plugin gets the fix now. nsolid-console-7 is already a commit behind main, so it should take main before its next release.

Approving.