SocketDev
diff --git a/‎socketsecurity/core/classes.py‎
Lines changed: 12 additions & 0 deletions b/‎socketsecurity/core/classes.py‎
Lines changed: 12 additions & 0 deletions
diff --git a/‎tests/core/test_package_and_alerts.py‎
Lines changed: 16 additions & 0 deletions b/‎tests/core/test_package_and_alerts.py‎
Lines changed: 16 additions & 0 deletions
@@ -1,4 +1,5 @@
 import json
+import logging
 from dataclasses import dataclass, field
 from typing import Dict, List, Optional, TypedDict
 
@@ -11,6 +12,8 @@
     SocketScore,
 )
 
+log = logging.getLogger("socketdev")
+
 # Separator between namespace and name in a socket.dev package URL. Socket addresses
 # Maven artifacts as "groupId:artifactId" -- the slash form 404s, and the dashboard's
 # Maven handler raises "Maven package must have a colon" on it. Every other ecosystem
@@ -180,6 +183,15 @@ def socket_url(package_type, namespace: Optional[str], name: str, version: str)
         package_type = Package.normalize_type(package_type)
         namespace = (namespace or "").strip("/")
         separator = URL_NAMESPACE_SEPARATORS.get(package_type, "/")
+        if separator != "/" and not namespace:
+            # An ecosystem with its own separator cannot be addressed without the
+            # namespace half of the coordinate. The link is emitted anyway so the
+            # finding still reports, but it will not resolve.
+            log.warning(
+                f"{package_type} package {name}@{version} has no namespace, so its "
+                f"Socket link cannot use the '{separator}' separator the dashboard "
+                "requires and will not resolve"
+            )
         package_path = f"{namespace}{separator}{name}" if namespace else name
         return f"https://socket.dev/{package_type}/package/{package_path}/overview/{version}"
 
 
@@ -157,6 +157,22 @@ def test_non_maven_package_url_keeps_slash_separator(self):
         unscoped = Package.socket_url("nuget", None, "newtonsoft.json", "6.0.8")
         assert unscoped == "https://socket.dev/nuget/package/newtonsoft.json/overview/6.0.8"
 
+    def test_maven_package_without_namespace_warns(self, caplog):
+        """A Maven coordinate missing its groupId cannot produce a resolvable link"""
+        with caplog.at_level("WARNING", logger="socketdev"):
+            url = Package.socket_url("maven", None, "orphan-artifact", "1.0.0")
+
+        assert url == "https://socket.dev/maven/package/orphan-artifact/overview/1.0.0"
+        assert "orphan-artifact@1.0.0" in caplog.text
+        assert "no namespace" in caplog.text
+
+    def test_namespaced_maven_package_does_not_warn(self, caplog):
+        """The warning is for missing data, not for every Maven package"""
+        with caplog.at_level("WARNING", logger="socketdev"):
+            Package.socket_url("maven", "com.example", "artifact", "1.0.0")
+
+        assert caplog.text == ""
+
     def test_diff_path_builds_the_same_maven_url_as_the_full_scan_path(self):
         """Both package construction paths must agree, or links break on only some runs"""
         package = Package(