NPM import skips unfixed vulnerabilities
The [function that resolves version ranges](https://github.com/nexB/vulnerablecode/blob/58e3ff375f8cc40cd457aa8130a5ac5264e29cd7/vulnerabilities/scraper/npm.py#L68) for affected and fixed packages returns empty lists if either of the ranges is empty. For unfixed vulnerabilities, the fixed version range is usually empty, hence no data for those will be added.
diff --git a/vulnerabilities/scraper/npm.py b/vulnerabilities/scraper/npm.py
index f6196e5..bb52018 100644
--- a/vulnerabilities/scraper/npm.py
+++ b/vulnerabilities/scraper/npm.py
@@ -58,25 +58,22 @@ def get_all_versions(package_name):
 
 def extract_versions(package_name, aff_version_range, fixed_version_range):
     """
-    Seperate list of affected versions and fixed versions from all versions
-    using the ranges specified
+    Seperate list of affected versions and unaffected versions from all versions
+    using the ranges specified.
     """
-    # FIXME This skips unfixed vulnerabilities
-    if aff_version_range == '' or fixed_version_range == '':
-        return ([], [])
-
     aff_spec = semantic_version.NpmSpec(remove_spaces(aff_version_range))
     fix_spec = semantic_version.NpmSpec(remove_spaces(fixed_version_range))
     all_ver = get_all_versions(package_name)
     aff_ver = []
     fix_ver = []
+    # Unaffected version is that version which  is in the fixed_version_range
+    # or which is absent in the aff_version_range
     for ver in all_ver:
         cur_version = semantic_version.Version(ver)
-        if cur_version in aff_spec:
-            aff_ver.append(ver)
+        if cur_version in fix_spec or cur_version not in aff_spec:
+            fix_ver.append(ver)
         else:
-            if cur_version in fix_spec:
-                fix_ver.append(ver)
+            aff_ver.append(ver)
 
     return (aff_ver, fix_ver)
 
['vulnerabilities/scraper/npm.py']