@zakodium/sbom-tools

Tools to analyse CycloneDX SBOM files.

Installation

npm install @zakodium/sbom-tools

Usage

Generate SBOM file

The tools expect a SBOM file in CycloneDX JSON format, version 1.6.

npm

See https://github.com/CycloneDX/cyclonedx-node-npm.

A compatible SBOM can be generated with:

npx --package @cyclonedx/cyclonedx-npm cyclonedx-npm --omit=dev --spec-version=1.6 --gather-license-texts --output-reproducible --output-file=sbom.json

Yarn

See https://github.com/CycloneDX/cyclonedx-node-yarn

A compatible SBOM can be generated with:

yarn dlx -q @cyclonedx/yarn-plugin-cyclonedx --production --spec-version=1.6 --gather-license-texts --output-reproducible --output-file=sbom.json

License

MIT