{"$schema":"http://cyclonedx.org/schema/bom-1.7.schema.json","bomFormat":"CycloneDX","specVersion":"1.7","serialNumber":"urn:uuid:31ba85a9-d5d2-4e6a-9f76-2c4debb0cf4c","version":1,"metadata":{"timestamp":"2026-10-15T10:14:44+09:00","tools":{"components":[{"type":"application","author":"anchore","name":"syft","version":"1.54.1"}]},"component":{"bom-ref":"8c034efe46bb9430","type":"file","name":"~/projects/sca-benchmark-wt/refresh-latest/fixtures/node-lock"}},"components":[{"bom-ref":"pkg:npm/debug@4.3.1?package-id=0af4971e72c456ca","type":"library","name":"debug","version":"4.3.1","licenses":[{"license":{"id":"MIT"}}],"cpe":"cpe:2.3:a:debug_project:debug:4.3.1:*:*:*:*:node.js:*:*","purl":"pkg:npm/debug@4.3.1","properties":[{"name":"syft:package:foundBy","value":"javascript-lock-cataloger"},{"name":"syft:package:language","value":"javascript"},{"name":"syft:package:type","value":"npm"},{"name":"syft:package:metadataType","value":"javascript-npm-package-lock-entry"},{"name":"syft:location:0:path","value":"/package-lock.json"}]},{"bom-ref":"pkg:npm/minimist@1.2.5?package-id=545fcbfd94ce86b5","type":"library","name":"minimist","version":"1.2.5","licenses":[{"license":{"id":"MIT"}}],"cpe":"cpe:2.3:a:minimist:minimist:1.2.5:*:*:*:*:*:*:*","purl":"pkg:npm/minimist@1.2.5","properties":[{"name":"syft:package:foundBy","value":"javascript-lock-cataloger"},{"name":"syft:package:language","value":"javascript"},{"name":"syft:package:type","value":"npm"},{"name":"syft:package:metadataType","value":"javascript-npm-package-lock-entry"},{"name":"syft:location:0:path","value":"/package-lock.json"}]},{"bom-ref":"pkg:npm/ms@2.1.2?package-id=99566b592187a2c5","type":"library","name":"ms","version":"2.1.2","licenses":[{"license":{"id":"MIT"}}],"cpe":"cpe:2.3:a:vercel:ms:2.1.2:*:*:*:*:node.js:*:*","purl":"pkg:npm/ms@2.1.2","properties":[{"name":"syft:package:foundBy","value":"javascript-lock-cataloger"},{"name":"syft:package:language","value":"javascript"},{"name":"syft:package:type","value":"npm"},{"name":"syft:package:metadataType","value":"javascript-npm-package-lock-entry"},{"name":"syft:location:0:path","value":"/package-lock.json"}]},{"bom-ref":"pkg:npm/node-lock@1.0.0?package-id=a01590cc8da9adaa","type":"library","name":"node-lock","version":"1.0.0","licenses":[{"license":{"id":"Apache-2.0"}}],"cpe":"cpe:2.3:a:node-lock:node-lock:1.0.0:*:*:*:*:*:*:*","purl":"pkg:npm/node-lock@1.0.0","properties":[{"name":"syft:package:foundBy","value":"javascript-lock-cataloger"},{"name":"syft:package:language","value":"javascript"},{"name":"syft:package:type","value":"npm"},{"name":"syft:package:metadataType","value":"javascript-npm-package-lock-entry"},{"name":"syft:cpe23","value":"cpe:2.3:a:node-lock:node_lock:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:node_lock:node-lock:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:node_lock:node_lock:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:node:node-lock:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:node:node_lock:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/package-lock.json"}]},{"bom-ref":"fd71c2238fc07657","type":"file","name":"~/projects/sca-benchmark-wt/refresh-latest/fixtures/node-lock/package-lock.json","hashes":[{"alg":"SHA-1","content":"ded81b0976eccb2f5b2be2626cd59268a576e7d7"},{"alg":"SHA-256","content":"6d964810c39688a590df832e10b13c17fb62c3cf8b6e54d6a20f8690a49a21ca"}]}],"dependencies":[{"ref":"pkg:npm/debug@4.3.1?package-id=0af4971e72c456ca","dependsOn":["pkg:npm/ms@2.1.2?package-id=99566b592187a2c5"]},{"ref":"pkg:npm/node-lock@1.0.0?package-id=a01590cc8da9adaa","dependsOn":["pkg:npm/debug@4.3.1?package-id=0af4971e72c456ca","pkg:npm/minimist@1.2.5?package-id=545fcbfd94ce86b5"]}]}