feat: add EPSS Priority Signal (severity x exploitation likelihood)

README.md

@@ -210,7 +210,7 @@ The closer a security tool is to a developer's natural workflow, the more likely
 
 ## How it compares
 
-No other free tool combines all of the following: lockfile scanning across npm, pnpm, Yarn, and Bun; parent-aware transitive remediation that tells you which package to upgrade (not just which one is vulnerable); fix version validation before suggesting an upgrade; a fully offline advisory DB for restricted environments; and CVE + license compliance scanning in a single pass.
+No other free tool combines all of the following: lockfile scanning across npm, pnpm, Yarn, and Bun; parent-aware transitive remediation that tells you which package to upgrade (not just which one is vulnerable); fix version validation before suggesting an upgrade; a fully offline advisory DB for restricted environments; CVE + license compliance scanning in a single pass; and an EPSS priority signal that combines CVSS severity with exploitation likelihood into four actionable tiers.
 
 | Capability | CVE Lite CLI | npm audit | OSV-Scanner | Snyk CLI | Socket CLI |
 |---|:---:|:---:|:---:|:---:|:---:|
@@ -232,6 +232,7 @@ No other free tool combines all of the following: lockfile scanning across npm,
 | [Override hygiene auditing](https://owasp.org/cve-lite-cli/docs/override-hygiene) | ✅ | ❌ | ❌ | ❌ | ❌ |
 | [Maintenance-risk detection (CVE-fix drag)](https://owasp.org/cve-lite-cli/docs/maintenance-risk) | ✅ | ❌ | ❌ | ❌ | ❌ |
 | [License compliance scanning (copyleft / unknown)](https://owasp.org/cve-lite-cli/docs/cli-reference#license-scanning-options) | ✅ | ❌ | ❌ | ⚠️ | ⚠️ |
+| [Priority signal: CVSS severity × EPSS exploitation likelihood](https://owasp.org/cve-lite-cli/docs/cli-reference#epss-priority-signal) | ✅ | ❌ | ❌ | ⚠️ | ❌ |
 
 <sub>✅ = built-in strength · ⚠️ = partial or workflow-dependent · ❌ = not a core strength</sub>
 

src/output/formatters.ts

@@ -15,6 +15,7 @@ import { getPrimaryParent, getRootDependencies } from "../utils/finding.js";
 import { calculatePathCoverage, formatDependencyPath } from "../utils/path-coverage.js";
 import { pluralize } from "../utils/string.js";
 import { hasMaliciousAdvisory } from "../utils/vuln.js";
+import { computePrioritySignal } from "../utils/priority-signal.js";
 
 export function formatRelationshipLabel(value: string): string {
   if (value.startsWith("direct")) return chalk.green(value);
@@ -304,6 +305,7 @@ export function serializeFinding(finding: Finding, plan?: SuggestedFixCommandPla
     recommendedNpmTransitiveRemediation: finding.recommendedNpmTransitiveRemediation ?? null,
     cves: finding.cveAliases,
     epssScores: finding.epssScores ?? null,
+    prioritySignal: computePrioritySignal(finding.severity, finding.epssScores) ?? null,
     dependencyPaths: finding.dependencyPaths,
     usage: finding.usage ?? null,
     maliciousUnverifiable: finding.maliciousUnverifiable ?? false,
@@ -315,6 +317,7 @@ export function serializeFinding(finding: Finding, plan?: SuggestedFixCommandPla
       aliases: v.aliases ?? [],
       summary: v.summary ?? "",
       severity: inferSeverity(v),
+      cvssScore: (v.severity ?? []).find(s => s.type?.startsWith("CVSS"))?.score ?? null,
     })),
   };
 }