Vulnerable JavaScript library checker

Identification reads the fixed list of 26 library signatures below, and a version counts only when the URL itself states one: a full x.y.z file name, path segment, or npm tag. Query strings like ?ver= are ignored on purpose, because on many sites that value tracks the site build rather than the library. The advisory answers come from OSV.dev, a free and keyless service that aggregates GitHub Security Advisories and npm advisory data. The safety rule: an unreachable database, a version the URL never stated, and a file no signature matched all read as not checked, never as a clean pass. Script files a bundler wrote carry neither a library name nor a version, so they are invisible here; a source map or a build-time SBOM names them honestly.