{"bom":{"annotations":[{"annotator":{"component":{"authors":[{"name":"OWASP Foundation"}],"bom-ref":"pkg:npm/@cdxgen/cdxgen@13.3.0","group":"@cdxgen","name":"cdxgen","publisher":"OWASP Foundation","purl":"pkg:npm/%40cdxgen/cdxgen@13.3.0","type":"application","version":"13.3.0"}},"bom-ref":"metadata-annotations","subjects":["pkg:npm/scab-bun-lock@1.0.0"],"text":"This Software Bill-of-Materials (SBOM) document was created on Wednesday, October 14, 2026 with cdxgen. The data was captured during the build lifecycle phase. The document describes an application named 'scab-bun-lock' with version '1.0.0'.","timestamp":"2026-10-14T22:36:33Z"}],"bomFormat":"CycloneDX","components":[{"bom-ref":"pkg:npm/debug@4.3.4","description":"Lightweight debugging utility for Node.js and the browser","evidence":{"identity":[{"concludedValue":"bun.lock","confidence":1,"field":"purl","methods":[{"confidence":1,"technique":"manifest-analysis","value":"bun.lock"}]}]},"externalReferences":[{"type":"distribution","url":"https://registry.npmjs.org/debug/-/debug-4.3.4.tgz"}],"group":"","hashes":[{"alg":"SHA-512","content":"3d15851ee494dde0ed4093ef9cd63b25c91eb758f4b793ae3ac1733cfcec7a40f9d9997ca947c520f122b305ea22f1d61951ce817fbb1bfbc234d85e870c5f91"}],"licenses":[{"license":{"id":"MIT","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:license:foss","value":"true"},{"name":"cdx:license:osiApproved","value":"true"},{"name":"cdx:license:fsfLibre","value":"true"},{"name":"cdx:license:deprecated","value":"false"}],"url":"https://opensource.org/licenses/MIT"}}],"name":"debug","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:npm:artifactIntegrity","value":"sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ=="},{"name":"cdx:npm:artifactShasum","value":"1319f6579357f2338d3337d2cdd4914bb5dcc865"},{"name":"cdx:npm:lastModifiedTime","value":"2025-09-13T17:25:19.913Z"},{"name":"cdx:npm:maintainerOverlapCount","value":"8"},{"name":"cdx:npm:maintainerOverlapRatio","value":"1.00"},{"name":"cdx:npm:maintainerSet","value":"qix, josh@junon.me, thebigredgeek, rhyneandrew@gmail.com, tootallnate, nathan@tootallnate.net, tjholowaychuk, tj@vision-media.ca"},{"name":"cdx:npm:maintainerSetCount","value":"8"},{"name":"cdx:npm:packageCreatedTime","value":"2011-11-29T01:11:23.618Z"},{"name":"cdx:npm:priorMaintainerSet","value":"qix, josh@junon.me, thebigredgeek, rhyneandrew@gmail.com, tootallnate, nathan@tootallnate.net, tjholowaychuk, tj@vision-media.ca"},{"name":"cdx:npm:priorMaintainerSetCount","value":"8"},{"name":"cdx:npm:priorPublishTime","value":"2021-11-27T13:14:24.425Z"},{"name":"cdx:npm:priorPublisher","value":"qix"},{"name":"cdx:npm:priorVersion","value":"4.3.3"},{"name":"cdx:npm:publishTime","value":"2022-03-17T13:38:47.641Z"},{"name":"cdx:npm:publisher","value":"qix"},{"name":"cdx:npm:publisherEmail","value":"josh@junon.me"},{"name":"cdx:npm:releaseCadenceCompressionRatio","value":"11.51"},{"name":"cdx:npm:releaseGapBaselineDays","value":"9.56"},{"name":"cdx:npm:releaseGapDays","value":"110.02"},{"name":"cdx:npm:releaseGapSampleSize","value":"69"},{"name":"cdx:npm:versionCount","value":"78"},{"name":"internal:ResolvedUrl","value":"https://registry.npmjs.org/debug/-/debug-4.3.4.tgz"},{"name":"internal:SrcFile","value":"bun.lock"},{"name":"bomlens:licenseClass","value":"permissive"}],"purl":"pkg:npm/debug@4.3.4","type":"library","version":"4.3.4"},{"bom-ref":"pkg:npm/ms@2.1.2","description":"Tiny millisecond conversion utility","evidence":{"identity":[{"concludedValue":"bun.lock","confidence":1,"field":"purl","methods":[{"confidence":1,"technique":"manifest-analysis","value":"bun.lock"}]}]},"externalReferences":[{"type":"distribution","url":"https://registry.npmjs.org/ms/-/ms-2.1.2.tgz"}],"group":"","hashes":[{"alg":"SHA-512","content":"b0690fc7e56332d980e8c5f6ee80381411442c50996784b85ea7863970afebcb53fa36f7be4fd1c9a2963f43d32b25ad98b48cd1bf9a7544c4bdbb353c4687db"}],"licenses":[{"license":{"id":"MIT","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:license:foss","value":"true"},{"name":"cdx:license:osiApproved","value":"true"},{"name":"cdx:license:fsfLibre","value":"true"},{"name":"cdx:license:deprecated","value":"false"}],"url":"https://opensource.org/licenses/MIT"}}],"name":"ms","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:npm:artifactIntegrity","value":"sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w=="},{"name":"cdx:npm:artifactShasum","value":"d09d1f357b443f493382a8eb3ccd183872ae6009"},{"name":"cdx:npm:lastModifiedTime","value":"2025-09-08T19:56:54.242Z"},{"name":"cdx:npm:maintainerOverlapCount","value":"4"},{"name":"cdx:npm:maintainerOverlapRatio","value":"0.04"},{"name":"cdx:npm:maintainerSet","value":"alexaltea, alexandro@phi.nz, anatrajkovska, ana.trajkovska2015@gmail.com, andybitz, artzbitz@gmail.com, arunoda, arunoda.susiripala@gmail.com, arzafran, franco@basement.studio, atcastle, atcastle@gmail.com, b3nnyl, ciao@sylin.me, caarlos0, caarlos0@gmail.com, codetheory, thecodetheory@gmail.com, coetry, allenhai03@gmail.com, dav-is, mail@connordav.is, fivepointseven, fivepointseven@icloud.com, guybedford, guybedford@gmail.com, hharnisc, hharnisc@gmail.com, huvik, lukas@huvar.cz, iamevilrabbit, hello@evilrabb.it, igorklopov, igor@klopov.com, ijjk, jj@jjsweb.site, janicklas-ralph, janicklasralph036@gmail.com, javivelasco, javier.velasco86@gmail.com, joecohens, joecohenr@gmail.com, juancampa, juancampa@gmail.com, leo, leo@zeit.co, lfades, luisito453@gmail.com, lucleray, luc.leray@gmail.com, manovotny, manovotny@gmail.com, marcosnils, marcosnils@gmail.com, matheuss, me@matheus.top, mfix22, mrfix84@gmail.com, mglagola, mark.glagola@gmail.com, msweeneydev, mail@msweeneydev.com, nkzawa, naoyuki.kanezawa@gmail.com, olliv, olli@zeit.co, paco, pvco.coursey@gmail.com, paulogdm, paulogdemitri@gmail.com, quietshu, ds303077135@gmail.com, rabaut, rabautse@gmail.com, ragojose, ragojosefrancisco@gmail.com, rauchg, rauchg@gmail.com, sarupbanskota, sbanskota08@gmail.com, skllcrn, skllcrn@zeit.co, sophearak, t.sophearak@gmail.com, styfle, steven@ceriously.com, timer, timer150@gmail.com, timneutkens, tim@timneutkens.nl, tootallnate, nathan@tootallnate.net, umegaya, iyatomi@gmail.com, williamli, williamli@bbi.io, zeit-bot, team@zeit.co"},{"name":"cdx:npm:maintainerSetCount","value":"98"},{"name":"cdx:npm:maintainerSetPartialDrift","value":"true"},{"name":"cdx:npm:packageCreatedTime","value":"2011-12-21T19:38:08.664Z"},{"name":"cdx:npm:priorMaintainerSet","value":"leo, leo@zeit.co, rauchg, rauchg@gmail.com"},{"name":"cdx:npm:priorMaintainerSetCount","value":"4"},{"name":"cdx:npm:priorPublishTime","value":"2017-11-30T18:30:16.876Z"},{"name":"cdx:npm:priorPublisher","value":"leo"},{"name":"cdx:npm:priorVersion","value":"2.1.1"},{"name":"cdx:npm:publishTime","value":"2019-06-06T17:31:55.859Z"},{"name":"cdx:npm:publisher","value":"styfle"},{"name":"cdx:npm:publisherDrift","value":"true"},{"name":"cdx:npm:publisherEmail","value":"steven@ceriously.com"},{"name":"cdx:npm:releaseCadenceCompressionRatio","value":"6.73"},{"name":"cdx:npm:releaseGapBaselineDays","value":"82.22"},{"name":"cdx:npm:releaseGapDays","value":"552.96"},{"name":"cdx:npm:releaseGapSampleSize","value":"16"},{"name":"cdx:npm:versionCount","value":"32"},{"name":"internal:ResolvedUrl","value":"https://registry.npmjs.org/ms/-/ms-2.1.2.tgz"},{"name":"internal:SrcFile","value":"bun.lock"},{"name":"bomlens:licenseClass","value":"permissive"}],"purl":"pkg:npm/ms@2.1.2","tags":["cloud","icloud"],"type":"library","version":"2.1.2"}],"dependencies":[{"dependsOn":["pkg:npm/ms@2.1.2"],"ref":"pkg:npm/debug@4.3.4"},{"dependsOn":[],"ref":"pkg:npm/ms@2.1.2"},{"dependsOn":["pkg:npm/debug@4.3.4"],"ref":"pkg:npm/scab-bun-lock@1.0.0"}],"metadata":{"component":{"bom-ref":"pkg:npm/scab-bun-lock@1.0.0","group":"","name":"bun-lock","properties":[{"name":"bomlens:source:versionPinning","value":"unpinned"}],"type":"application","version":"1.0.0"},"lifecycles":[{"phase":"pre-build"}],"properties":[{"name":"cdx:bom:componentSrcFiles","value":"bun.lock"},{"name":"cdx:bom:componentTypes","value":"npm"},{"name":"bomlens:prep-step-applied","value":"npm-production-set"},{"name":"bomlens:excluded-paths","value":"**/test/**, **/tests/**, **/spec/**, **/fixtures/**, **/testdata/**, **/__tests__/**, **/e2e/**, **/example/**, **/examples/**, **/sample/**, **/samples/**, **/bench/**, **/benches/**, **/benchmark/**, **/benchmarks/**, **/demo/**, **/demos/**, **/playground/**, **/.github/workflows/**, **/gradle/wrapper/**"},{"name":"bomlens:undeclared-fields","value":"unknown-to-author"}],"timestamp":"2026-10-14T22:36:33Z","tools":{"components":[{"authors":[{"name":"OWASP Foundation"}],"bom-ref":"pkg:npm/@cdxgen/cdxgen@13.3.0","group":"@cdxgen","name":"cdxgen","publisher":"OWASP Foundation","purl":"pkg:npm/%40cdxgen/cdxgen@13.3.0","type":"application","version":"13.3.0"},{"name":"BomLens","publisher":"SK Telecom","type":"application","version":"1.13.4"}]}},"serialNumber":"urn:uuid:d9501a81-1b87-49d9-9f22-0a7bca9e42f3","services":[],"specVersion":"1.6","version":1,"compositions":[{"aggregate":"complete"}]},"security":{"SchemaVersion":2,"Trivy":{"Version":"0.75.0"},"ReportID":"01a13c8f-e8ec-79c1-a30c-c62a3ac7875b","CreatedAt":"2026-10-14T22:37:06.668641994Z","ArtifactName":"bun-lock_1.0.0_bom.json","ArtifactType":"cyclonedx","Results":[{"Target":"Node.js","Class":"lang-pkgs","Type":"node-pkg","Packages":[{"ID":"debug@4.3.4","Name":"debug","Identifier":{"PURL":"pkg:npm/debug@4.3.4","UID":"b2672cdbabef3c81","BOMRef":"pkg:npm/debug@4.3.4"},"Version":"4.3.4","Licenses":["MIT"],"DependsOn":["ms@2.1.2"],"Digest":"sha512:3d15851ee494dde0ed4093ef9cd63b25c91eb758f4b793ae3ac1733cfcec7a40f9d9997ca947c520f122b305ea22f1d61951ce817fbb1bfbc234d85e870c5f91"},{"ID":"ms@2.1.2","Name":"ms","Identifier":{"PURL":"pkg:npm/ms@2.1.2","UID":"980c6e163d28bdc2","BOMRef":"pkg:npm/ms@2.1.2"},"Version":"2.1.2","Licenses":["MIT"],"Digest":"sha512:b0690fc7e56332d980e8c5f6ee80381411442c50996784b85ea7863970afebcb53fa36f7be4fd1c9a2963f43d32b25ad98b48cd1bf9a7544c4bdbb353c4687db"}]}],"UncheckedComponents":{"Count":0,"Components":[]}},"scancode":{"headers":[{"tool_name":"scancode-toolkit","tool_version":"32.5.0","options":{"input":["/src"],"--ignore":["node_modules","vendor","bower_components",".venv","venv","virtualenv","site-packages","dist","build","target","out",".next",".nuxt","__pycache__",".gradle",".git",".hg",".svn",".tox",".mypy_cache",".pytest_cache",".ruff_cache",".idea",".vscode","bun-lock_1.0.0"],"--json-pp":"/tmp/bomlens-scancode.MZ7wNN","--license":true,"--only-findings":false,"--strip-root":true},"notice":"Generated with ScanCode and provided on an \"AS IS\" BASIS, WITHOUT WARRANTIES\nOR CONDITIONS OF ANY KIND, either express or implied. No content created from\nScanCode should be considered or used as legal advice. Consult an Attorney\nfor any legal advice.\nScanCode is a free software code scanning tool from nexB Inc. and others.\nVisit https://github.com/nexB/scancode-toolkit/ for support and download.","start_timestamp":"2026-10-14T223645.267383","end_timestamp":"2026-10-14T223649.294452","output_format_version":"4.1.0","duration":4.027099847793579,"message":null,"errors":[],"warnings":[],"extra_data":{"system_environment":{"operating_system":"linux","cpu_architecture":"64","platform":"Linux-6.8.0-100-generic-aarch64-with-glibc2.41","platform_version":"#100-Ubuntu SMP PREEMPT_DYNAMIC Tue Jan 13 16:39:21 UTC 2026","python_version":"3.12.14 (main, Sep 19 2026, 01:11:14) [GCC 14.2.0]"},"spdx_license_list_version":"3.27","files_count":2}}],"license_detections":[],"files":[{"path":"bun.lock","type":"file","detected_license_expression":null,"detected_license_expression_spdx":null,"license_detections":[],"license_clues":[],"percentage_of_license_text":0,"scan_errors":[]},{"path":"package.json","type":"file","detected_license_expression":null,"detected_license_expression_spdx":null,"license_detections":[],"license_clues":[],"percentage_of_license_text":0,"scan_errors":[]}]}}