{ "bomFormat": "CycloneDX", "specVersion": "1.7", "serialNumber": "urn:uuid:e616266f-a833-4ce2-ab8e-cce03d7030cd", "version": 1, "metadata": { "timestamp": "2026-07-30T16:38:49Z", "tools": { "components": [ { "group": "@cyclonedx", "name": "cdxgen", "version": "12.3.3", "purl": "pkg:npm/%40cyclonedx/cdxgen@12.3.3", "type": "application", "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.3.3", "publisher": "OWASP Foundation", "authors": [ { "name": "OWASP Foundation" } ] } ] }, "authors": [ { "name": "OWASP Foundation" } ], "lifecycles": [ { "phase": "pre-build" } ], "component": { "name": "cbor", "group": "", "version": "10.0.12", "description": "Encode and parse data in the Concise Binary Object Representation (CBOR) data format (RFC8949).", "purl": "pkg:npm/cbor@10.0.12", "bom-ref": "pkg:npm/cbor@10.0.12", "author": "Joe Hildebrand ", "properties": [], "type": "application", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "externalReferences": [ { "type": "vcs", "url": "https://github.com/hildjj/node-cbor/tree/main/packages/cbor" }, { "type": "vcs", "url": "git+ssh://git@github.com/hildjj/node-cbor.git" } ] }, "properties": [ { "name": "cdx:bom:componentTypes", "value": "npm" }, { "name": "cdx:bom:componentNamespaces", "value": "@types" }, { "name": "cdx:bom:componentSrcFiles", "value": "node_modules/@types/node/package.json\\nnode_modules/bignumber.js/package.json\\nnode_modules/garbage/package.json\\nnode_modules/nofilter/package.json\\nnode_modules/p-event/package.json\\nnode_modules/rimraf/package.json" } ] }, "components": [ { "authors": [ { "name": "Isaac Z. Schlueter (http://blog.izs.me/)" } ], "group": "", "name": "rimraf", "version": "6.1.3", "description": "A deep deletion module for node (like `rm -rf`)", "scope": "optional", "licenses": [ { "license": { "id": "BlueOak-1.0.0", "url": "https://opensource.org/licenses/BlueOak-1.0.0" } } ], "purl": "pkg:npm/rimraf@6.1.3", "type": "library", "bom-ref": "pkg:npm/rimraf@6.1.3", "properties": [ { "name": "SrcFile", "value": "node_modules/rimraf/package.json" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/rimraf/package.json" } ], "concludedValue": "node_modules/rimraf/package.json" } ] } }, { "authors": [ { "name": "Sindre Sorhus (https://sindresorhus.com)" } ], "group": "", "name": "p-event", "version": "4.2.0", "description": "Promisify an event by waiting for it to be emitted", "scope": "optional", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "purl": "pkg:npm/p-event@4.2.0", "type": "library", "bom-ref": "pkg:npm/p-event@4.2.0", "properties": [ { "name": "SrcFile", "value": "node_modules/p-event/package.json" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/p-event/package.json" } ], "concludedValue": "node_modules/p-event/package.json" } ] }, "tags": [ "event" ] }, { "authors": [ { "name": "Joe Hildebrand " } ], "group": "", "name": "nofilter", "version": "3.1.0", "description": "Read and write a growable buffer as a stream", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "purl": "pkg:npm/nofilter@3.1.0", "externalReferences": [ { "type": "vcs", "url": "https://github.com/hildjj/nofilter#readme" }, { "type": "vcs", "url": "git+https://github.com/hildjj/nofilter.git" } ], "type": "library", "bom-ref": "pkg:npm/nofilter@3.1.0", "properties": [ { "name": "SrcFile", "value": "node_modules/nofilter/package.json" }, { "name": "ImportedModules", "value": "nofilter" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/nofilter/package.json" } ], "concludedValue": "node_modules/nofilter/package.json" } ], "occurrences": [ { "location": "lib/commented.js#6" }, { "location": "lib/decoder.js#7" }, { "location": "lib/diagnose.js#6" }, { "location": "lib/encoder.js#4" }, { "location": "lib/utils.js#4" }, { "location": "vendor/binary-parse-stream/index.js#13" } ] } }, { "authors": [ { "name": "James Halliday (http://substack.net)" } ], "group": "", "name": "garbage", "version": "0.0.0", "description": "generate garbage json data", "scope": "optional", "licenses": [ { "license": { "name": "MIT/X11" } } ], "purl": "pkg:npm/garbage@0.0.0", "externalReferences": [ { "type": "vcs", "url": "http://github.com/substack/node-garbage.git" } ], "type": "library", "bom-ref": "pkg:npm/garbage@0.0.0", "properties": [ { "name": "SrcFile", "value": "node_modules/garbage/package.json" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/garbage/package.json" } ], "concludedValue": "node_modules/garbage/package.json" } ] }, "tags": [ "json" ] }, { "authors": [ { "name": "Michael Mclaughlin " } ], "group": "", "name": "bignumber.js", "version": "10.0.2", "description": "A library for arbitrary-precision decimal and non-decimal arithmetic", "scope": "optional", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "purl": "pkg:npm/bignumber.js@10.0.2", "externalReferences": [ { "type": "vcs", "url": "https://github.com/MikeMcl/bignumber.js.git" } ], "type": "library", "bom-ref": "pkg:npm/bignumber.js@10.0.2", "properties": [ { "name": "SrcFile", "value": "node_modules/bignumber.js/package.json" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/bignumber.js/package.json" } ], "concludedValue": "node_modules/bignumber.js/package.json" } ] } }, { "group": "@types", "name": "node", "version": "25.3.3", "description": "TypeScript definitions for node", "scope": "optional", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT" } } ], "purl": "pkg:npm/%40types/node@25.3.3", "externalReferences": [ { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node" }, { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped.git" } ], "type": "library", "bom-ref": "pkg:npm/@types/node@25.3.3", "properties": [ { "name": "SrcFile", "value": "node_modules/@types/node/package.json" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@types/node/package.json" } ], "concludedValue": "node_modules/@types/node/package.json" } ] } } ], "dependencies": [], "annotations": [ { "bom-ref": "metadata-annotations", "subjects": [ "pkg:npm/cbor@10.0.12" ], "annotator": { "component": { "group": "@cyclonedx", "name": "cdxgen", "version": "12.3.3", "purl": "pkg:npm/%40cyclonedx/cdxgen@12.3.3", "type": "application", "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.3.3", "publisher": "OWASP Foundation", "authors": [ { "name": "OWASP Foundation" } ] } }, "timestamp": "2026-07-30T16:38:49Z", "text": "This Software Bill-of-Materials (SBOM) document was created on Thursday, July 30, 2026 with cdxgen. The data was captured during the pre-build lifecycle phase without building the application. The document describes an application named 'cbor' with version '10.0.12'. The package type in this SBOM is npm with a single purl namespace '@types' described under components. The components were identified from 6 source files." } ] }