{"bom":{"annotations":[{"annotator":{"component":{"authors":[{"name":"OWASP Foundation"}],"bom-ref":"pkg:npm/@cdxgen/cdxgen@13.3.0","group":"@cdxgen","name":"cdxgen","publisher":"OWASP Foundation","purl":"pkg:npm/%40cdxgen/cdxgen@13.3.0","type":"application","version":"13.3.0"}},"bom-ref":"metadata-annotations","subjects":["pkg:npm/scab-npm-nonshipped@1.0.0"],"text":"This Software Bill-of-Materials (SBOM) document was created on Wednesday, October 14, 2026 with cdxgen. The data was captured during the build lifecycle phase. The document describes an application named 'scab-npm-nonshipped' with version '1.0.0'.","timestamp":"2026-10-14T22:56:17Z"}],"bomFormat":"CycloneDX","components":[{"bom-ref":"pkg:npm/debug@4.3.4","description":"Lightweight debugging utility for Node.js and the browser","evidence":{"identity":[{"concludedValue":"package-lock.json","confidence":1,"field":"purl","methods":[{"confidence":1,"technique":"manifest-analysis","value":"package-lock.json"}]}],"occurrences":[{"line":1,"location":"index.js"}]},"externalReferences":[{"type":"distribution","url":"https://registry.npmjs.org/debug/-/debug-4.3.4.tgz"}],"group":"","hashes":[{"alg":"SHA-512","content":"3d15851ee494dde0ed4093ef9cd63b25c91eb758f4b793ae3ac1733cfcec7a40f9d9997ca947c520f122b305ea22f1d61951ce817fbb1bfbc234d85e870c5f91"}],"licenses":[{"license":{"id":"MIT","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:license:foss","value":"true"},{"name":"cdx:license:osiApproved","value":"true"},{"name":"cdx:license:fsfLibre","value":"true"},{"name":"cdx:license:deprecated","value":"false"}],"url":"https://opensource.org/licenses/MIT"}}],"name":"debug","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:npm:artifactIntegrity","value":"sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ=="},{"name":"cdx:npm:artifactShasum","value":"1319f6579357f2338d3337d2cdd4914bb5dcc865"},{"name":"cdx:npm:lastModifiedTime","value":"2025-09-13T17:25:19.913Z"},{"name":"cdx:npm:maintainerOverlapCount","value":"8"},{"name":"cdx:npm:maintainerOverlapRatio","value":"1.00"},{"name":"cdx:npm:maintainerSet","value":"qix, josh@junon.me, thebigredgeek, rhyneandrew@gmail.com, tootallnate, nathan@tootallnate.net, tjholowaychuk, tj@vision-media.ca"},{"name":"cdx:npm:maintainerSetCount","value":"8"},{"name":"cdx:npm:packageCreatedTime","value":"2011-11-29T01:11:23.618Z"},{"name":"cdx:npm:priorMaintainerSet","value":"qix, josh@junon.me, thebigredgeek, rhyneandrew@gmail.com, tootallnate, nathan@tootallnate.net, tjholowaychuk, tj@vision-media.ca"},{"name":"cdx:npm:priorMaintainerSetCount","value":"8"},{"name":"cdx:npm:priorPublishTime","value":"2021-11-27T13:14:24.425Z"},{"name":"cdx:npm:priorPublisher","value":"qix"},{"name":"cdx:npm:priorVersion","value":"4.3.3"},{"name":"cdx:npm:publishTime","value":"2022-03-17T13:38:47.641Z"},{"name":"cdx:npm:publisher","value":"qix"},{"name":"cdx:npm:publisherEmail","value":"josh@junon.me"},{"name":"cdx:npm:releaseCadenceCompressionRatio","value":"11.51"},{"name":"cdx:npm:releaseGapBaselineDays","value":"9.56"},{"name":"cdx:npm:releaseGapDays","value":"110.02"},{"name":"cdx:npm:releaseGapSampleSize","value":"69"},{"name":"cdx:npm:versionCount","value":"78"},{"name":"internal:ImportedModules","value":"debug"},{"name":"internal:ResolvedUrl","value":"https://registry.npmjs.org/debug/-/debug-4.3.4.tgz"},{"name":"internal:SrcFile","value":"package-lock.json"},{"name":"bomlens:licenseClass","value":"permissive"}],"purl":"pkg:npm/debug@4.3.4","scope":"required","type":"library","version":"4.3.4"},{"bom-ref":"pkg:npm/ms@2.1.2","description":"Tiny millisecond conversion utility","evidence":{"identity":[{"concludedValue":"package-lock.json","confidence":1,"field":"purl","methods":[{"confidence":1,"technique":"manifest-analysis","value":"package-lock.json"}]}]},"externalReferences":[{"type":"distribution","url":"https://registry.npmjs.org/ms/-/ms-2.1.2.tgz"}],"group":"","hashes":[{"alg":"SHA-512","content":"b0690fc7e56332d980e8c5f6ee80381411442c50996784b85ea7863970afebcb53fa36f7be4fd1c9a2963f43d32b25ad98b48cd1bf9a7544c4bdbb353c4687db"}],"licenses":[{"license":{"id":"MIT","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:license:foss","value":"true"},{"name":"cdx:license:osiApproved","value":"true"},{"name":"cdx:license:fsfLibre","value":"true"},{"name":"cdx:license:deprecated","value":"false"}],"url":"https://opensource.org/licenses/MIT"}}],"name":"ms","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:npm:artifactIntegrity","value":"sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w=="},{"name":"cdx:npm:artifactShasum","value":"d09d1f357b443f493382a8eb3ccd183872ae6009"},{"name":"cdx:npm:lastModifiedTime","value":"2025-09-08T19:56:54.242Z"},{"name":"cdx:npm:maintainerOverlapCount","value":"4"},{"name":"cdx:npm:maintainerOverlapRatio","value":"0.04"},{"name":"cdx:npm:maintainerSet","value":"alexaltea, alexandro@phi.nz, anatrajkovska, ana.trajkovska2015@gmail.com, andybitz, artzbitz@gmail.com, arunoda, arunoda.susiripala@gmail.com, arzafran, franco@basement.studio, atcastle, atcastle@gmail.com, b3nnyl, ciao@sylin.me, caarlos0, caarlos0@gmail.com, codetheory, thecodetheory@gmail.com, coetry, allenhai03@gmail.com, dav-is, mail@connordav.is, fivepointseven, fivepointseven@icloud.com, guybedford, guybedford@gmail.com, hharnisc, hharnisc@gmail.com, huvik, lukas@huvar.cz, iamevilrabbit, hello@evilrabb.it, igorklopov, igor@klopov.com, ijjk, jj@jjsweb.site, janicklas-ralph, janicklasralph036@gmail.com, javivelasco, javier.velasco86@gmail.com, joecohens, joecohenr@gmail.com, juancampa, juancampa@gmail.com, leo, leo@zeit.co, lfades, luisito453@gmail.com, lucleray, luc.leray@gmail.com, manovotny, manovotny@gmail.com, marcosnils, marcosnils@gmail.com, matheuss, me@matheus.top, mfix22, mrfix84@gmail.com, mglagola, mark.glagola@gmail.com, msweeneydev, mail@msweeneydev.com, nkzawa, naoyuki.kanezawa@gmail.com, olliv, olli@zeit.co, paco, pvco.coursey@gmail.com, paulogdm, paulogdemitri@gmail.com, quietshu, ds303077135@gmail.com, rabaut, rabautse@gmail.com, ragojose, ragojosefrancisco@gmail.com, rauchg, rauchg@gmail.com, sarupbanskota, sbanskota08@gmail.com, skllcrn, skllcrn@zeit.co, sophearak, t.sophearak@gmail.com, styfle, steven@ceriously.com, timer, timer150@gmail.com, timneutkens, tim@timneutkens.nl, tootallnate, nathan@tootallnate.net, umegaya, iyatomi@gmail.com, williamli, williamli@bbi.io, zeit-bot, team@zeit.co"},{"name":"cdx:npm:maintainerSetCount","value":"98"},{"name":"cdx:npm:maintainerSetPartialDrift","value":"true"},{"name":"cdx:npm:packageCreatedTime","value":"2011-12-21T19:38:08.664Z"},{"name":"cdx:npm:priorMaintainerSet","value":"leo, leo@zeit.co, rauchg, rauchg@gmail.com"},{"name":"cdx:npm:priorMaintainerSetCount","value":"4"},{"name":"cdx:npm:priorPublishTime","value":"2017-11-30T18:30:16.876Z"},{"name":"cdx:npm:priorPublisher","value":"leo"},{"name":"cdx:npm:priorVersion","value":"2.1.1"},{"name":"cdx:npm:publishTime","value":"2019-06-06T17:31:55.859Z"},{"name":"cdx:npm:publisher","value":"styfle"},{"name":"cdx:npm:publisherDrift","value":"true"},{"name":"cdx:npm:publisherEmail","value":"steven@ceriously.com"},{"name":"cdx:npm:releaseCadenceCompressionRatio","value":"6.73"},{"name":"cdx:npm:releaseGapBaselineDays","value":"82.22"},{"name":"cdx:npm:releaseGapDays","value":"552.96"},{"name":"cdx:npm:releaseGapSampleSize","value":"16"},{"name":"cdx:npm:versionCount","value":"32"},{"name":"internal:ResolvedUrl","value":"https://registry.npmjs.org/ms/-/ms-2.1.2.tgz"},{"name":"internal:SrcFile","value":"package-lock.json"},{"name":"bomlens:licenseClass","value":"permissive"}],"purl":"pkg:npm/ms@2.1.2","scope":"required","tags":["cloud","icloud"],"type":"library","version":"2.1.2"}],"dependencies":[{"dependsOn":[],"ref":"pkg:npm/ms@2.1.2"},{"dependsOn":["pkg:npm/ms@2.1.2"],"ref":"pkg:npm/debug@4.3.4"},{"dependsOn":["pkg:npm/debug@4.3.4"],"ref":"pkg:npm/scab-npm-nonshipped@1.0.0"}],"metadata":{"component":{"bom-ref":"pkg:npm/scab-npm-nonshipped@1.0.0","group":"","name":"npm-nonshipped","properties":[{"name":"bomlens:source:versionPinning","value":"pinned"}],"type":"application","version":"1.0.0"},"lifecycles":[{"phase":"pre-build"}],"properties":[{"name":"cdx:bom:componentSrcFiles","value":"package-lock.json"},{"name":"cdx:bom:componentTypes","value":"npm"},{"name":"bomlens:prep-step-applied","value":"npm-production-set"},{"name":"bomlens:excluded-paths","value":"**/test/**, **/tests/**, **/spec/**, **/fixtures/**, **/testdata/**, **/__tests__/**, **/e2e/**, **/example/**, **/examples/**, **/sample/**, **/samples/**, **/bench/**, **/benches/**, **/benchmark/**, **/benchmarks/**, **/demo/**, **/demos/**, **/playground/**, **/.github/workflows/**, **/gradle/wrapper/**"},{"name":"bomlens:excluded-manifests","value":"examples/demo/package-lock.json, examples/demo/package.json, test/fixtures/app/package-lock.json, test/fixtures/app/package.json"},{"name":"bomlens:undeclared-fields","value":"unknown-to-author"}],"timestamp":"2026-10-14T22:56:17Z","tools":{"components":[{"authors":[{"name":"OWASP Foundation"}],"bom-ref":"pkg:npm/@cdxgen/cdxgen@13.3.0","group":"@cdxgen","name":"cdxgen","publisher":"OWASP Foundation","purl":"pkg:npm/%40cdxgen/cdxgen@13.3.0","type":"application","version":"13.3.0"},{"name":"BomLens","publisher":"SK Telecom","type":"application","version":"1.13.4"}]}},"serialNumber":"urn:uuid:0712a36a-3903-40f9-a2ab-29e26166773c","services":[],"specVersion":"1.6","version":1,"compositions":[{"aggregate":"complete"}]},"security":{"SchemaVersion":2,"Trivy":{"Version":"0.75.0"},"ReportID":"01a13ca1-e6cd-74f1-a71f-6b700d21a7c6","CreatedAt":"2026-10-14T22:56:45.773325403Z","ArtifactName":"npm-nonshipped_1.0.0_bom.json","ArtifactType":"cyclonedx","Results":[{"Target":"Node.js","Class":"lang-pkgs","Type":"node-pkg","Packages":[{"ID":"debug@4.3.4","Name":"debug","Identifier":{"PURL":"pkg:npm/debug@4.3.4","UID":"b2672cdbabef3c81","BOMRef":"pkg:npm/debug@4.3.4"},"Version":"4.3.4","Licenses":["MIT"],"DependsOn":["ms@2.1.2"],"Digest":"sha512:3d15851ee494dde0ed4093ef9cd63b25c91eb758f4b793ae3ac1733cfcec7a40f9d9997ca947c520f122b305ea22f1d61951ce817fbb1bfbc234d85e870c5f91"},{"ID":"ms@2.1.2","Name":"ms","Identifier":{"PURL":"pkg:npm/ms@2.1.2","UID":"980c6e163d28bdc2","BOMRef":"pkg:npm/ms@2.1.2"},"Version":"2.1.2","Licenses":["MIT"],"Digest":"sha512:b0690fc7e56332d980e8c5f6ee80381411442c50996784b85ea7863970afebcb53fa36f7be4fd1c9a2963f43d32b25ad98b48cd1bf9a7544c4bdbb353c4687db"}]}],"UncheckedComponents":{"Count":0,"Components":[]}},"scancode":{"headers":[{"tool_name":"scancode-toolkit","tool_version":"32.5.0","options":{"input":["/src"],"--ignore":["node_modules","vendor","bower_components",".venv","venv","virtualenv","site-packages","dist","build","target","out",".next",".nuxt","__pycache__",".gradle",".git",".hg",".svn",".tox",".mypy_cache",".pytest_cache",".ruff_cache",".idea",".vscode","npm-nonshipped_1.0.0"],"--json-pp":"/tmp/bomlens-scancode.mT1Vm5","--license":true,"--only-findings":false,"--strip-root":true},"notice":"Generated with ScanCode and provided on an \"AS IS\" BASIS, WITHOUT WARRANTIES\nOR CONDITIONS OF ANY KIND, either express or implied. No content created from\nScanCode should be considered or used as legal advice. Consult an Attorney\nfor any legal advice.\nScanCode is a free software code scanning tool from nexB Inc. and others.\nVisit https://github.com/nexB/scancode-toolkit/ for support and download.","start_timestamp":"2026-10-14T225626.986851","end_timestamp":"2026-10-14T225630.306261","output_format_version":"4.1.0","duration":3.3194239139556885,"message":null,"errors":[],"warnings":[],"extra_data":{"system_environment":{"operating_system":"linux","cpu_architecture":"64","platform":"Linux-6.8.0-100-generic-aarch64-with-glibc2.41","platform_version":"#100-Ubuntu SMP PREEMPT_DYNAMIC Tue Jan 13 16:39:21 UTC 2026","python_version":"3.12.14 (main, Sep 19 2026, 01:11:14) [GCC 14.2.0]"},"spdx_license_list_version":"3.27","files_count":8}}],"license_detections":[{"identifier":"mit-3fce6ea2-8abd-6c6b-3ede-a37af7c6efee","license_expression":"mit","license_expression_spdx":"MIT","detection_count":4,"reference_matches":[{"license_expression":"mit","license_expression_spdx":"MIT","from_file":"src/package-lock.json","start_line":21,"end_line":21,"matcher":"2-aho","score":100,"matched_length":2,"match_coverage":100,"rule_relevance":100,"rule_identifier":"mit_30.RULE","rule_url":"https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/mit_30.RULE"}]},{"identifier":"wtfpl_2_0-6bb91b8f-711e-123e-f214-718d6541cd9d","license_expression":"wtfpl-2.0","license_expression_spdx":"WTFPL","detection_count":1,"reference_matches":[{"license_expression":"wtfpl-2.0","license_expression_spdx":"WTFPL","from_file":"src/examples/demo/package-lock.json","start_line":18,"end_line":18,"matcher":"2-aho","score":100,"matched_length":2,"match_coverage":100,"rule_relevance":100,"rule_identifier":"wtfpl-2.0_33.RULE","rule_url":"https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/wtfpl-2.0_33.RULE"}]}],"files":[{"path":"index.js","type":"file","detected_license_expression":null,"detected_license_expression_spdx":null,"license_detections":[],"license_clues":[],"percentage_of_license_text":0,"scan_errors":[]},{"path":"package-lock.json","type":"file","detected_license_expression":"mit","detected_license_expression_spdx":"MIT","license_detections":[{"license_expression":"mit","license_expression_spdx":"MIT","matches":[{"license_expression":"mit","license_expression_spdx":"MIT","from_file":"src/package-lock.json","start_line":21,"end_line":21,"matcher":"2-aho","score":100,"matched_length":2,"match_coverage":100,"rule_relevance":100,"rule_identifier":"mit_30.RULE","rule_url":"https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/mit_30.RULE"}],"identifier":"mit-3fce6ea2-8abd-6c6b-3ede-a37af7c6efee"},{"license_expression":"mit","license_expression_spdx":"MIT","matches":[{"license_expression":"mit","license_expression_spdx":"MIT","from_file":"src/package-lock.json","start_line":33,"end_line":33,"matcher":"2-aho","score":100,"matched_length":2,"match_coverage":100,"rule_relevance":100,"rule_identifier":"mit_30.RULE","rule_url":"https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/mit_30.RULE"}],"identifier":"mit-3fce6ea2-8abd-6c6b-3ede-a37af7c6efee"},{"license_expression":"mit","license_expression_spdx":"MIT","matches":[{"license_expression":"mit","license_expression_spdx":"MIT","from_file":"src/package-lock.json","start_line":39,"end_line":39,"matcher":"2-aho","score":100,"matched_length":2,"match_coverage":100,"rule_relevance":100,"rule_identifier":"mit_30.RULE","rule_url":"https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/mit_30.RULE"}],"identifier":"mit-3fce6ea2-8abd-6c6b-3ede-a37af7c6efee"}],"license_clues":[],"percentage_of_license_text":4.88,"scan_errors":[]},{"path":"package.json","type":"file","detected_license_expression":null,"detected_license_expression_spdx":null,"license_detections":[],"license_clues":[],"percentage_of_license_text":0,"scan_errors":[]},{"path":"examples","type":"directory","detected_license_expression":null,"detected_license_expression_spdx":null,"license_detections":[],"license_clues":[],"percentage_of_license_text":0,"scan_errors":[]},{"path":"examples/demo","type":"directory","detected_license_expression":null,"detected_license_expression_spdx":null,"license_detections":[],"license_clues":[],"percentage_of_license_text":0,"scan_errors":[]},{"path":"examples/demo/index.js","type":"file","detected_license_expression":null,"detected_license_expression_spdx":null,"license_detections":[],"license_clues":[],"percentage_of_license_text":0,"scan_errors":[]},{"path":"examples/demo/package-lock.json","type":"file","detected_license_expression":"wtfpl-2.0","detected_license_expression_spdx":"WTFPL","license_detections":[{"license_expression":"wtfpl-2.0","license_expression_spdx":"WTFPL","matches":[{"license_expression":"wtfpl-2.0","license_expression_spdx":"WTFPL","from_file":"src/examples/demo/package-lock.json","start_line":18,"end_line":18,"matcher":"2-aho","score":100,"matched_length":2,"match_coverage":100,"rule_relevance":100,"rule_identifier":"wtfpl-2.0_33.RULE","rule_url":"https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/wtfpl-2.0_33.RULE"}],"identifier":"wtfpl_2_0-6bb91b8f-711e-123e-f214-718d6541cd9d"}],"license_clues":[],"percentage_of_license_text":3.7,"scan_errors":[]},{"path":"examples/demo/package.json","type":"file","detected_license_expression":null,"detected_license_expression_spdx":null,"license_detections":[],"license_clues":[],"percentage_of_license_text":0,"scan_errors":[]},{"path":"test","type":"directory","detected_license_expression":null,"detected_license_expression_spdx":null,"license_detections":[],"license_clues":[],"percentage_of_license_text":0,"scan_errors":[]},{"path":"test/fixtures","type":"directory","detected_license_expression":null,"detected_license_expression_spdx":null,"license_detections":[],"license_clues":[],"percentage_of_license_text":0,"scan_errors":[]},{"path":"test/fixtures/app","type":"directory","detected_license_expression":null,"detected_license_expression_spdx":null,"license_detections":[],"license_clues":[],"percentage_of_license_text":0,"scan_errors":[]},{"path":"test/fixtures/app/package-lock.json","type":"file","detected_license_expression":"mit","detected_license_expression_spdx":"MIT","license_detections":[{"license_expression":"mit","license_expression_spdx":"MIT","matches":[{"license_expression":"mit","license_expression_spdx":"MIT","from_file":"src/test/fixtures/app/package-lock.json","start_line":18,"end_line":18,"matcher":"2-aho","score":100,"matched_length":2,"match_coverage":100,"rule_relevance":100,"rule_identifier":"mit_30.RULE","rule_url":"https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/mit_30.RULE"}],"identifier":"mit-3fce6ea2-8abd-6c6b-3ede-a37af7c6efee"}],"license_clues":[],"percentage_of_license_text":3.51,"scan_errors":[]},{"path":"test/fixtures/app/package.json","type":"file","detected_license_expression":null,"detected_license_expression_spdx":null,"license_detections":[],"license_clues":[],"percentage_of_license_text":0,"scan_errors":[]}]}}