Tool name: CycloneDX SBOM for npm

[jkowalleck]

homepage_url

https://github.com/CycloneDX/cyclonedx-node-npm?tab=readme-ov-file#readme

contact_email

jan.kowalleck [at] owasp.org

code_view_url

https://github.com/CycloneDX/cyclonedx-node-npm

spdx_license_expression

Apache-2.0

description

Create CycloneDX Software Bill of Materials (SBOM) from [npm] projects.

Based on OWASP Software Component Verification Standard for Software Bill of Materials's
criteria, this tool is capable of producing SBOM documents almost passing Level-2 (only signing needs to be done externally).

The resulting SBOM documents follow official specifications and standards,
and might have properties following cdx:npm Namespace Taxonomy
.

primary_languages

TypeScript

short_term_roadmap

all things are community efforts - come and help/contribute

• [FEAT] support workspaces CycloneDX/cyclonedx-node-npm#1126
• FEAT: render property cdx:reproducible CycloneDX/cyclonedx-node-npm#1054
• Add support for node v24
• BC: drop support for node<v20.18 CycloneDX/cyclonedx-node-npm#1192
• Have known bugs fixed
• Continue supporting the community in contributing new features

long_term_roadmap

all things are community efforts - come and help/contribute

• basic support of upcoming CycloneDX 1.7.
  CDX 1.7 is expected around May/June 2025.
• FEAT: component de-duplication CycloneDX/cyclonedx-node-npm#306
• [FEATURE] library mode CycloneDX/cyclonedx-node-npm#1259
• feat: generate SBOM from "global" scope CycloneDX/cyclonedx-node-npm#471
• Maintenance, refactoring, etc
• Continue supporting the community in contributing new features

proprietary_data

• Yes, the tool depends on proprietary data sources

commercial_features

• Yes, the tool has a commercial version with different/additional features

capabilities

• Identifiers - Use Package-URL (PURL) identifiers
• Identifiers - Use SPDX license expressions
• Scanning - Analyze package manifests and lockfiles
• Scanning - Analyze package files
• Scanning - Scan for copyright
• Scanning - Scan for license
• Scanning - Analyze source code
• Scanning - Analyze containers
• Scanning - Analyze installed system packages (linux distros)
• Scanning - Analyze installed application packages
• Scanning - Other analysis
• Packages - Inventory packages
• Packages - Inventory packages dependencies
• Packages - Resolve dependencies
• Packages - Navigate or display dependency graph
• Compliance - Generate CycloneDX SBOMs
• Compliance - Generate SPDX SBOMs
• Compliance - Validate CycloneDX SBOM
• Compliance - Validate SPDX SBOMs
• Compliance - Generate CycloneDX VEX
• Compliance - Generate CSAF VEX
• Compliance - Generate OpenVex
• Compliance - Generate other compliance documents
• Policies - Define and check license policies
• Policies - Define and check security policies
• Policies - Define and check other policies
• Data - Database of Package metadata
• Data - Database of Package dependency relationships
• Data - Database of License obligations
• Data - Database of Licenses
• Data - Database of Vulnerabilities
• License - Help triage license issues
• License - Generate license credit and attribution notices
• License - Generate source code redistribution lists
• Vulnerabilities - Detect vulnerable code in packages
• Vulnerabilities - Find known vulnerabilities for package
• Vulnerabilities - Determine reachable vulnerabilities
• Vulnerabilities - Help triage vulnerabilities
• Binaries - Analyze binaries
• Binaries - Analyze ELF binaries
• Binaries - Analyze Windows binaries
• Binaries - Analyze firmware binaries
• Binaries - Analyze Other binaries
• Matching - Match source code
• Matching - Match binary code
• Tracing - Trace code execution
• Tracing - Trace build
• Code Security - Analyze code statically (SAST/linting)
• Code Security - Analyze code dynamically (DAST)
• Download - Source package
• Download - Source repositories
• Download - Binary package
• Deployment - Deployable as containers (Docker/OCI/k8s/etc)
• Deployment - Deployable in CI/CD pipelines
• Deployment - Deployable as a library
• Run - Run as a command line tool
• Run - Run as a web application
• Run - Run as an API service

other_capabilities

No response