fix ncm report to make its risk score consistent

nodesource / ncm-cli

Command-line tool for NodeSource Certified Modules 2.0

Other

19 stars 13 forks source link

Closed JungMinu closed 3 years ago

JungMinu commented 3 years ago

[x] skip unknown versions of packages to make the report consistent
[x] make quality scores do not affect a package’s risk level since a quality criteria does not offset a security vulnerability or risk attribute, NCM 2 does not assign an impact severity to a quality attribute: https://docs.nodesource.com/ncmv2/docs#quality-severity

JungMinu commented 3 years ago

@edsadr please review