{"bomFormat":"CycloneDX","specVersion":"1.6","serialNumber":"urn:uuid:1fbe709c-4f6a-49ed-9e20-7e5c969e9aa5","version":1,"metadata":{"timestamp":"2026-10-15T01:14:48Z","tools":{"components":[{"group":"@cdxgen","name":"cdxgen","version":"13.4.0","purl":"pkg:npm/%40cdxgen/cdxgen@13.4.0","type":"application","bom-ref":"pkg:npm/@cdxgen/cdxgen@13.4.0","publisher":"OWASP Foundation","authors":[{"name":"OWASP Foundation"}]}]},"authors":[{"name":"OWASP Foundation"}],"lifecycles":[{"phase":"build"}],"component":{"name":"node-lock","group":"","version":"1.0.0","description":"SCA 벤치마크 fixture — package-lock.json 포함(결정적). 직접/전이 그래프와 알려진 CVE.","purl":"pkg:npm/node-lock@1.0.0","bom-ref":"pkg:npm/node-lock@1.0.0","properties":[{"name":"cdx:license:category","value":"Permissive"}],"type":"application","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:license:foss","value":"true"},{"name":"cdx:license:osiApproved","value":"true"},{"name":"cdx:license:fsfLibre","value":"true"},{"name":"cdx:license:deprecated","value":"false"}]}}]},"properties":[{"name":"cdx:bom:componentSrcFiles","value":".cdxgen-work/node-lock-1792026886398/src/package-lock.json"},{"name":"cdx:bom:componentTypes","value":"npm"}]},"components":[{"group":"","name":"minimist","version":"1.2.5","description":"parse argument options","hashes":[{"alg":"SHA-512","content":"14cf6735462b4410042d9413df179943b7e630e060ea758d989293720b0979a2ecb4ffd43835691acaf93a15e185783a7feaad27cba267e3d4c640d67202172f"}],"licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:license:foss","value":"true"},{"name":"cdx:license:osiApproved","value":"true"},{"name":"cdx:license:fsfLibre","value":"true"},{"name":"cdx:license:deprecated","value":"false"}]}}],"purl":"pkg:npm/minimist@1.2.5","externalReferences":[{"type":"distribution","url":"https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz"}],"type":"library","bom-ref":"pkg:npm/minimist@1.2.5","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:npm:artifactIntegrity","value":"sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw=="},{"name":"cdx:npm:artifactShasum","value":"67d66014b66a6a8aaa0c083c5fd58df4e4e97602"},{"name":"cdx:npm:lastModifiedTime","value":"2026-03-06T07:15:54.567Z"},{"name":"cdx:npm:maintainerOverlapCount","value":"4"},{"name":"cdx:npm:maintainerOverlapRatio","value":"1.00"},{"name":"cdx:npm:maintainerSet","value":"emilbayes, github@tixz.dk, substack, substack@gmail.com"},{"name":"cdx:npm:maintainerSetCount","value":"4"},{"name":"cdx:npm:packageCreatedTime","value":"2013-06-25T08:17:16.343Z"},{"name":"cdx:npm:priorMaintainerSet","value":"emilbayes, github@tixz.dk, substack, substack@gmail.com"},{"name":"cdx:npm:priorMaintainerSetCount","value":"4"},{"name":"cdx:npm:priorPublishTime","value":"2020-03-12T22:15:03.676Z"},{"name":"cdx:npm:priorPublisher","value":"substack"},{"name":"cdx:npm:priorVersion","value":"0.2.1"},{"name":"cdx:npm:publishTime","value":"2020-03-12T22:16:19.463Z"},{"name":"cdx:npm:publisher","value":"substack"},{"name":"cdx:npm:publisherEmail","value":"substack@gmail.com"},{"name":"cdx:npm:releaseCadenceCompressionRatio","value":"0.00"},{"name":"cdx:npm:releaseGapBaselineDays","value":"12.03"},{"name":"cdx:npm:releaseGapDays","value":"0.00"},{"name":"cdx:npm:releaseGapSampleSize","value":"23"},{"name":"cdx:npm:versionCount","value":"31"},{"name":"internal:ResolvedUrl","value":"https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz"},{"name":"internal:SrcFile","value":".cdxgen-work/node-lock-1792026886398/src/package-lock.json"}],"evidence":{"identity":[{"field":"purl","confidence":1,"methods":[{"technique":"manifest-analysis","confidence":1,"value":".cdxgen-work/node-lock-1792026886398/src/package-lock.json"}],"concludedValue":".cdxgen-work/node-lock-1792026886398/src/package-lock.json"}]}},{"group":"","name":"debug","version":"4.3.1","description":"small debugging utility","hashes":[{"alg":"SHA-512","content":"76813076f9b83c278ae0add140dd990b60585016b1c0b0110aa666323b45f1ae7527645bd31a559681519c2383c2a8e9c270286a8e297a537c97744976fde045"}],"licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:license:foss","value":"true"},{"name":"cdx:license:osiApproved","value":"true"},{"name":"cdx:license:fsfLibre","value":"true"},{"name":"cdx:license:deprecated","value":"false"}]}}],"purl":"pkg:npm/debug@4.3.1","externalReferences":[{"type":"distribution","url":"https://registry.npmjs.org/debug/-/debug-4.3.1.tgz"}],"type":"library","bom-ref":"pkg:npm/debug@4.3.1","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:npm:artifactIntegrity","value":"sha512-doEwdvm4PCeK4K3RQN2ZC2BYUBaxwLARCqZmMjtF8a51J2Rb0xpVloFRnCODwqjpwnAoao4pelN8l3RJdv3gRQ=="},{"name":"cdx:npm:artifactShasum","value":"f0d229c505e0c6d8c49ac553d1b13dc183f6b2ee"},{"name":"cdx:npm:lastModifiedTime","value":"2025-09-13T17:25:19.913Z"},{"name":"cdx:npm:maintainerOverlapCount","value":"8"},{"name":"cdx:npm:maintainerOverlapRatio","value":"1.00"},{"name":"cdx:npm:maintainerSet","value":"qix, i.am.qix@gmail.com, thebigredgeek, rhyneandrew@gmail.com, tootallnate, nathan@tootallnate.net, tjholowaychuk, tj@vision-media.ca"},{"name":"cdx:npm:maintainerSetCount","value":"8"},{"name":"cdx:npm:packageCreatedTime","value":"2011-11-29T01:11:23.618Z"},{"name":"cdx:npm:priorMaintainerSet","value":"qix, i.am.qix@gmail.com, thebigredgeek, rhyneandrew@gmail.com, tootallnate, nathan@tootallnate.net, tjholowaychuk, tj@vision-media.ca"},{"name":"cdx:npm:priorMaintainerSetCount","value":"8"},{"name":"cdx:npm:priorPublishTime","value":"2020-09-19T08:36:29.497Z"},{"name":"cdx:npm:priorPublisher","value":"qix"},{"name":"cdx:npm:priorVersion","value":"4.3.0"},{"name":"cdx:npm:publishTime","value":"2020-11-19T12:23:08.941Z"},{"name":"cdx:npm:publisher","value":"qix"},{"name":"cdx:npm:publisherEmail","value":"i.am.qix@gmail.com"},{"name":"cdx:npm:releaseCadenceCompressionRatio","value":"8.85"},{"name":"cdx:npm:releaseGapBaselineDays","value":"6.91"},{"name":"cdx:npm:releaseGapDays","value":"61.16"},{"name":"cdx:npm:releaseGapSampleSize","value":"65"},{"name":"cdx:npm:versionCount","value":"78"},{"name":"internal:ResolvedUrl","value":"https://registry.npmjs.org/debug/-/debug-4.3.1.tgz"},{"name":"internal:SrcFile","value":".cdxgen-work/node-lock-1792026886398/src/package-lock.json"}],"evidence":{"identity":[{"field":"purl","confidence":1,"methods":[{"technique":"manifest-analysis","confidence":1,"value":".cdxgen-work/node-lock-1792026886398/src/package-lock.json"}],"concludedValue":".cdxgen-work/node-lock-1792026886398/src/package-lock.json"}]}},{"group":"","name":"ms","version":"2.1.2","description":"Tiny millisecond conversion utility","hashes":[{"alg":"SHA-512","content":"b0690fc7e56332d980e8c5f6ee80381411442c50996784b85ea7863970afebcb53fa36f7be4fd1c9a2963f43d32b25ad98b48cd1bf9a7544c4bdbb353c4687db"}],"licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:license:foss","value":"true"},{"name":"cdx:license:osiApproved","value":"true"},{"name":"cdx:license:fsfLibre","value":"true"},{"name":"cdx:license:deprecated","value":"false"}]}}],"purl":"pkg:npm/ms@2.1.2","externalReferences":[{"type":"distribution","url":"https://registry.npmjs.org/ms/-/ms-2.1.2.tgz"}],"type":"library","bom-ref":"pkg:npm/ms@2.1.2","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:npm:artifactIntegrity","value":"sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w=="},{"name":"cdx:npm:artifactShasum","value":"d09d1f357b443f493382a8eb3ccd183872ae6009"},{"name":"cdx:npm:lastModifiedTime","value":"2025-09-08T19:56:54.242Z"},{"name":"cdx:npm:maintainerOverlapCount","value":"4"},{"name":"cdx:npm:maintainerOverlapRatio","value":"0.04"},{"name":"cdx:npm:maintainerSet","value":"alexaltea, alexandro@phi.nz, anatrajkovska, ana.trajkovska2015@gmail.com, andybitz, artzbitz@gmail.com, arunoda, arunoda.susiripala@gmail.com, arzafran, franco@basement.studio, atcastle, atcastle@gmail.com, b3nnyl, ciao@sylin.me, caarlos0, caarlos0@gmail.com, codetheory, thecodetheory@gmail.com, coetry, allenhai03@gmail.com, dav-is, mail@connordav.is, fivepointseven, fivepointseven@icloud.com, guybedford, guybedford@gmail.com, hharnisc, hharnisc@gmail.com, huvik, lukas@huvar.cz, iamevilrabbit, hello@evilrabb.it, igorklopov, igor@klopov.com, ijjk, jj@jjsweb.site, janicklas-ralph, janicklasralph036@gmail.com, javivelasco, javier.velasco86@gmail.com, joecohens, joecohenr@gmail.com, juancampa, juancampa@gmail.com, leo, leo@zeit.co, lfades, luisito453@gmail.com, lucleray, luc.leray@gmail.com, manovotny, manovotny@gmail.com, marcosnils, marcosnils@gmail.com, matheuss, me@matheus.top, mfix22, mrfix84@gmail.com, mglagola, mark.glagola@gmail.com, msweeneydev, mail@msweeneydev.com, nkzawa, naoyuki.kanezawa@gmail.com, olliv, olli@zeit.co, paco, pvco.coursey@gmail.com, paulogdm, paulogdemitri@gmail.com, quietshu, ds303077135@gmail.com, rabaut, rabautse@gmail.com, ragojose, ragojosefrancisco@gmail.com, rauchg, rauchg@gmail.com, sarupbanskota, sbanskota08@gmail.com, skllcrn, skllcrn@zeit.co, sophearak, t.sophearak@gmail.com, styfle, steven@ceriously.com, timer, timer150@gmail.com, timneutkens, tim@timneutkens.nl, tootallnate, nathan@tootallnate.net, umegaya, iyatomi@gmail.com, williamli, williamli@bbi.io, zeit-bot, team@zeit.co"},{"name":"cdx:npm:maintainerSetCount","value":"98"},{"name":"cdx:npm:maintainerSetPartialDrift","value":"true"},{"name":"cdx:npm:packageCreatedTime","value":"2011-12-21T19:38:08.664Z"},{"name":"cdx:npm:priorMaintainerSet","value":"leo, leo@zeit.co, rauchg, rauchg@gmail.com"},{"name":"cdx:npm:priorMaintainerSetCount","value":"4"},{"name":"cdx:npm:priorPublishTime","value":"2017-11-30T18:30:16.876Z"},{"name":"cdx:npm:priorPublisher","value":"leo"},{"name":"cdx:npm:priorVersion","value":"2.1.1"},{"name":"cdx:npm:publishTime","value":"2019-06-06T17:31:55.859Z"},{"name":"cdx:npm:publisher","value":"styfle"},{"name":"cdx:npm:publisherDrift","value":"true"},{"name":"cdx:npm:publisherEmail","value":"steven@ceriously.com"},{"name":"cdx:npm:releaseCadenceCompressionRatio","value":"6.73"},{"name":"cdx:npm:releaseGapBaselineDays","value":"82.22"},{"name":"cdx:npm:releaseGapDays","value":"552.96"},{"name":"cdx:npm:releaseGapSampleSize","value":"16"},{"name":"cdx:npm:versionCount","value":"32"},{"name":"internal:ResolvedUrl","value":"https://registry.npmjs.org/ms/-/ms-2.1.2.tgz"},{"name":"internal:SrcFile","value":".cdxgen-work/node-lock-1792026886398/src/package-lock.json"}],"evidence":{"identity":[{"field":"purl","confidence":1,"methods":[{"technique":"manifest-analysis","confidence":1,"value":".cdxgen-work/node-lock-1792026886398/src/package-lock.json"}],"concludedValue":".cdxgen-work/node-lock-1792026886398/src/package-lock.json"}]},"tags":["cloud","icloud"]}],"services":[],"dependencies":[{"ref":"pkg:npm/minimist@1.2.5","dependsOn":[]},{"ref":"pkg:npm/ms@2.1.2","dependsOn":[]},{"ref":"pkg:npm/debug@4.3.1","dependsOn":["pkg:npm/ms@2.1.2"]},{"ref":"pkg:npm/node-lock@1.0.0","dependsOn":["pkg:npm/debug@4.3.1","pkg:npm/minimist@1.2.5"]}],"annotations":[{"bom-ref":"metadata-annotations","subjects":["pkg:npm/node-lock@1.0.0"],"annotator":{"component":{"group":"@cdxgen","name":"cdxgen","version":"13.4.0","purl":"pkg:npm/%40cdxgen/cdxgen@13.4.0","type":"application","bom-ref":"pkg:npm/@cdxgen/cdxgen@13.4.0","publisher":"OWASP Foundation","authors":[{"name":"OWASP Foundation"}]}},"timestamp":"2026-10-15T01:14:48Z","text":"This Software Bill-of-Materials (SBOM) document was created on Thursday, October 15, 2026 with cdxgen. The data was captured during the build lifecycle phase. The document describes an application named 'node-lock' with version '1.0.0'."}]}