{"bomFormat":"CycloneDX","specVersion":"1.6","serialNumber":"urn:uuid:f89a5430-3fe0-4cdf-a134-270eb4339533","version":1,"metadata":{"timestamp":"2026-10-15T01:15:57Z","tools":{"components":[{"group":"@cdxgen","name":"cdxgen","version":"13.4.0","purl":"pkg:npm/%40cdxgen/cdxgen@13.4.0","type":"application","bom-ref":"pkg:npm/@cdxgen/cdxgen@13.4.0","publisher":"OWASP Foundation","authors":[{"name":"OWASP Foundation"}]}]},"authors":[{"name":"OWASP Foundation"}],"lifecycles":[{"phase":"build"}],"component":{"name":"scab-npm-nonshipped","group":"","version":"1.0.0","purl":"pkg:npm/scab-npm-nonshipped@1.0.0","bom-ref":"pkg:npm/scab-npm-nonshipped@1.0.0","properties":[],"type":"application","components":[{"group":"","name":"scab-test-fixture-app","version":"0.0.0","purl":"pkg:npm/scab-test-fixture-app@0.0.0","type":"application","bom-ref":"pkg:npm/scab-test-fixture-app@0.0.0"},{"group":"","name":"scab-example-demo","version":"0.0.0","purl":"pkg:npm/scab-example-demo@0.0.0","type":"application","bom-ref":"pkg:npm/scab-example-demo@0.0.0"}]},"properties":[{"name":"cdx:bom:componentSrcFiles","value":".cdxgen-work/npm-nonshipped-1792026955603/src/examples/demo/package-lock.json\\n.cdxgen-work/npm-nonshipped-1792026955603/src/package-lock.json\\n.cdxgen-work/npm-nonshipped-1792026955603/src/test/fixtures/app/package-lock.json"},{"name":"cdx:bom:componentTypes","value":"npm"}]},"components":[{"group":"","name":"debug","version":"4.3.4","description":"Lightweight debugging utility for Node.js and the browser","scope":"required","hashes":[{"alg":"SHA-512","content":"3d15851ee494dde0ed4093ef9cd63b25c91eb758f4b793ae3ac1733cfcec7a40f9d9997ca947c520f122b305ea22f1d61951ce817fbb1bfbc234d85e870c5f91"}],"licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:license:foss","value":"true"},{"name":"cdx:license:osiApproved","value":"true"},{"name":"cdx:license:fsfLibre","value":"true"},{"name":"cdx:license:deprecated","value":"false"}]}}],"purl":"pkg:npm/debug@4.3.4","externalReferences":[{"type":"distribution","url":"https://registry.npmjs.org/debug/-/debug-4.3.4.tgz"}],"type":"library","bom-ref":"pkg:npm/debug@4.3.4","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:npm:artifactIntegrity","value":"sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ=="},{"name":"cdx:npm:artifactShasum","value":"1319f6579357f2338d3337d2cdd4914bb5dcc865"},{"name":"cdx:npm:lastModifiedTime","value":"2025-09-13T17:25:19.913Z"},{"name":"cdx:npm:maintainerOverlapCount","value":"8"},{"name":"cdx:npm:maintainerOverlapRatio","value":"1.00"},{"name":"cdx:npm:maintainerSet","value":"qix, josh@junon.me, thebigredgeek, rhyneandrew@gmail.com, tootallnate, nathan@tootallnate.net, tjholowaychuk, tj@vision-media.ca"},{"name":"cdx:npm:maintainerSetCount","value":"8"},{"name":"cdx:npm:packageCreatedTime","value":"2011-11-29T01:11:23.618Z"},{"name":"cdx:npm:priorMaintainerSet","value":"qix, josh@junon.me, thebigredgeek, rhyneandrew@gmail.com, tootallnate, nathan@tootallnate.net, tjholowaychuk, tj@vision-media.ca"},{"name":"cdx:npm:priorMaintainerSetCount","value":"8"},{"name":"cdx:npm:priorPublishTime","value":"2021-11-27T13:14:24.425Z"},{"name":"cdx:npm:priorPublisher","value":"qix"},{"name":"cdx:npm:priorVersion","value":"4.3.3"},{"name":"cdx:npm:publishTime","value":"2022-03-17T13:38:47.641Z"},{"name":"cdx:npm:publisher","value":"qix"},{"name":"cdx:npm:publisherEmail","value":"josh@junon.me"},{"name":"cdx:npm:releaseCadenceCompressionRatio","value":"11.51"},{"name":"cdx:npm:releaseGapBaselineDays","value":"9.56"},{"name":"cdx:npm:releaseGapDays","value":"110.02"},{"name":"cdx:npm:releaseGapSampleSize","value":"69"},{"name":"cdx:npm:versionCount","value":"78"},{"name":"internal:ImportedModules","value":"debug"},{"name":"internal:ResolvedUrl","value":"https://registry.npmjs.org/debug/-/debug-4.3.4.tgz"},{"name":"internal:SrcFile","value":".cdxgen-work/npm-nonshipped-1792026955603/src/package-lock.json"}],"evidence":{"identity":[{"field":"purl","confidence":1,"methods":[{"technique":"manifest-analysis","confidence":1,"value":".cdxgen-work/npm-nonshipped-1792026955603/src/package-lock.json"}],"concludedValue":".cdxgen-work/npm-nonshipped-1792026955603/src/package-lock.json"}],"occurrences":[{"location":"index.js","line":1}]}},{"group":"","name":"ms","version":"2.1.2","description":"Tiny millisecond conversion utility","scope":"required","hashes":[{"alg":"SHA-512","content":"b0690fc7e56332d980e8c5f6ee80381411442c50996784b85ea7863970afebcb53fa36f7be4fd1c9a2963f43d32b25ad98b48cd1bf9a7544c4bdbb353c4687db"}],"licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:license:foss","value":"true"},{"name":"cdx:license:osiApproved","value":"true"},{"name":"cdx:license:fsfLibre","value":"true"},{"name":"cdx:license:deprecated","value":"false"}]}}],"purl":"pkg:npm/ms@2.1.2","externalReferences":[{"type":"distribution","url":"https://registry.npmjs.org/ms/-/ms-2.1.2.tgz"}],"type":"library","bom-ref":"pkg:npm/ms@2.1.2","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:npm:artifactIntegrity","value":"sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w=="},{"name":"cdx:npm:artifactShasum","value":"d09d1f357b443f493382a8eb3ccd183872ae6009"},{"name":"cdx:npm:lastModifiedTime","value":"2025-09-08T19:56:54.242Z"},{"name":"cdx:npm:maintainerOverlapCount","value":"4"},{"name":"cdx:npm:maintainerOverlapRatio","value":"0.04"},{"name":"cdx:npm:maintainerSet","value":"alexaltea, alexandro@phi.nz, anatrajkovska, ana.trajkovska2015@gmail.com, andybitz, artzbitz@gmail.com, arunoda, arunoda.susiripala@gmail.com, arzafran, franco@basement.studio, atcastle, atcastle@gmail.com, b3nnyl, ciao@sylin.me, caarlos0, caarlos0@gmail.com, codetheory, thecodetheory@gmail.com, coetry, allenhai03@gmail.com, dav-is, mail@connordav.is, fivepointseven, fivepointseven@icloud.com, guybedford, guybedford@gmail.com, hharnisc, hharnisc@gmail.com, huvik, lukas@huvar.cz, iamevilrabbit, hello@evilrabb.it, igorklopov, igor@klopov.com, ijjk, jj@jjsweb.site, janicklas-ralph, janicklasralph036@gmail.com, javivelasco, javier.velasco86@gmail.com, joecohens, joecohenr@gmail.com, juancampa, juancampa@gmail.com, leo, leo@zeit.co, lfades, luisito453@gmail.com, lucleray, luc.leray@gmail.com, manovotny, manovotny@gmail.com, marcosnils, marcosnils@gmail.com, matheuss, me@matheus.top, mfix22, mrfix84@gmail.com, mglagola, mark.glagola@gmail.com, msweeneydev, mail@msweeneydev.com, nkzawa, naoyuki.kanezawa@gmail.com, olliv, olli@zeit.co, paco, pvco.coursey@gmail.com, paulogdm, paulogdemitri@gmail.com, quietshu, ds303077135@gmail.com, rabaut, rabautse@gmail.com, ragojose, ragojosefrancisco@gmail.com, rauchg, rauchg@gmail.com, sarupbanskota, sbanskota08@gmail.com, skllcrn, skllcrn@zeit.co, sophearak, t.sophearak@gmail.com, styfle, steven@ceriously.com, timer, timer150@gmail.com, timneutkens, tim@timneutkens.nl, tootallnate, nathan@tootallnate.net, umegaya, iyatomi@gmail.com, williamli, williamli@bbi.io, zeit-bot, team@zeit.co"},{"name":"cdx:npm:maintainerSetCount","value":"98"},{"name":"cdx:npm:maintainerSetPartialDrift","value":"true"},{"name":"cdx:npm:packageCreatedTime","value":"2011-12-21T19:38:08.664Z"},{"name":"cdx:npm:priorMaintainerSet","value":"leo, leo@zeit.co, rauchg, rauchg@gmail.com"},{"name":"cdx:npm:priorMaintainerSetCount","value":"4"},{"name":"cdx:npm:priorPublishTime","value":"2017-11-30T18:30:16.876Z"},{"name":"cdx:npm:priorPublisher","value":"leo"},{"name":"cdx:npm:priorVersion","value":"2.1.1"},{"name":"cdx:npm:publishTime","value":"2019-06-06T17:31:55.859Z"},{"name":"cdx:npm:publisher","value":"styfle"},{"name":"cdx:npm:publisherDrift","value":"true"},{"name":"cdx:npm:publisherEmail","value":"steven@ceriously.com"},{"name":"cdx:npm:releaseCadenceCompressionRatio","value":"6.73"},{"name":"cdx:npm:releaseGapBaselineDays","value":"82.22"},{"name":"cdx:npm:releaseGapDays","value":"552.96"},{"name":"cdx:npm:releaseGapSampleSize","value":"16"},{"name":"cdx:npm:versionCount","value":"32"},{"name":"internal:ResolvedUrl","value":"https://registry.npmjs.org/ms/-/ms-2.1.2.tgz"},{"name":"internal:SrcFile","value":".cdxgen-work/npm-nonshipped-1792026955603/src/package-lock.json"}],"evidence":{"identity":[{"field":"purl","confidence":1,"methods":[{"technique":"manifest-analysis","confidence":1,"value":".cdxgen-work/npm-nonshipped-1792026955603/src/package-lock.json"}],"concludedValue":".cdxgen-work/npm-nonshipped-1792026955603/src/package-lock.json"}]},"tags":["cloud","icloud"]},{"group":"","name":"is-number","version":"7.0.0","description":"Returns true if a number or string value is a finite number. Useful for regex matches, parsing, user input, etc.","scope":"optional","hashes":[{"alg":"SHA-512","content":"e350a27e483a7bc4f2952a5db53a5e2d532abd20445734edb47bc4443ef8d7ea6767c00dbf4d34e0c44be3740a3c394af5c1af369e8d6566540656c65d8c719e"}],"licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:license:foss","value":"true"},{"name":"cdx:license:osiApproved","value":"true"},{"name":"cdx:license:fsfLibre","value":"true"},{"name":"cdx:license:deprecated","value":"false"}]}}],"purl":"pkg:npm/is-number@7.0.0","externalReferences":[{"type":"distribution","url":"https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz"}],"type":"library","bom-ref":"pkg:npm/is-number@7.0.0","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:npm:artifactIntegrity","value":"sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng=="},{"name":"cdx:npm:artifactShasum","value":"7535345b896734d5f80c4d06c50955527a14f12b"},{"name":"cdx:npm:lastModifiedTime","value":"2023-05-26T16:12:33.057Z"},{"name":"cdx:npm:maintainerOverlapCount","value":"6"},{"name":"cdx:npm:maintainerOverlapRatio","value":"1.00"},{"name":"cdx:npm:maintainerSet","value":"doowb, brian.woodward@gmail.com, jonschlinkert, github@sellside.com, realityking, me@rouvenwessling.de"},{"name":"cdx:npm:maintainerSetCount","value":"6"},{"name":"cdx:npm:package:development","value":"true"},{"name":"cdx:npm:packageCreatedTime","value":"2014-09-22T01:58:51.592Z"},{"name":"cdx:npm:priorMaintainerSet","value":"doowb, brian.woodward@gmail.com, jonschlinkert, github@sellside.com, realityking, me@rouvenwessling.de"},{"name":"cdx:npm:priorMaintainerSetCount","value":"6"},{"name":"cdx:npm:priorPublishTime","value":"2018-03-31T17:02:39.953Z"},{"name":"cdx:npm:priorPublisher","value":"jonschlinkert"},{"name":"cdx:npm:priorVersion","value":"6.0.0"},{"name":"cdx:npm:publishTime","value":"2018-07-04T15:08:58.238Z"},{"name":"cdx:npm:publisher","value":"jonschlinkert"},{"name":"cdx:npm:publisherEmail","value":"github@sellside.com"},{"name":"cdx:npm:releaseCadenceCompressionRatio","value":"1.65"},{"name":"cdx:npm:releaseGapBaselineDays","value":"57.55"},{"name":"cdx:npm:releaseGapDays","value":"94.92"},{"name":"cdx:npm:releaseGapSampleSize","value":"13"},{"name":"cdx:npm:versionCount","value":"15"},{"name":"internal:ResolvedUrl","value":"https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz"},{"name":"internal:SrcFile","value":".cdxgen-work/npm-nonshipped-1792026955603/src/package-lock.json"}],"evidence":{"identity":[{"field":"purl","confidence":1,"methods":[{"technique":"manifest-analysis","confidence":1,"value":".cdxgen-work/npm-nonshipped-1792026955603/src/package-lock.json"}],"concludedValue":".cdxgen-work/npm-nonshipped-1792026955603/src/package-lock.json"}]}},{"group":"","name":"kind-of","version":"6.0.3","description":"Get the native type of a value.","hashes":[{"alg":"SHA-512","content":"75c4b5ba5fbdb66783f794fec76f3f7a12e077d98435adcbb2f0d3b739b7bf20443bb44fa6dbc00feb78e165576948d305172ba45785942f160abb94478e7a87"}],"licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:license:foss","value":"true"},{"name":"cdx:license:osiApproved","value":"true"},{"name":"cdx:license:fsfLibre","value":"true"},{"name":"cdx:license:deprecated","value":"false"}]}}],"purl":"pkg:npm/kind-of@6.0.3","externalReferences":[{"type":"distribution","url":"https://registry.npmjs.org/kind-of/-/kind-of-6.0.3.tgz"}],"type":"library","bom-ref":"pkg:npm/kind-of@6.0.3","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:npm:artifactIntegrity","value":"sha512-dcS1ul+9tmeD95T+x28/ehLgd9mENa3LsvDTtzm3vyBEO7RPptvAD+t44WVXaUjTBRcrpFeFlC8WCruUR456hw=="},{"name":"cdx:npm:artifactShasum","value":"07c05034a6c349fa06e24fa35aa76db4580ce4dd"},{"name":"cdx:npm:lastModifiedTime","value":"2023-07-12T19:12:21.548Z"},{"name":"cdx:npm:maintainerOverlapCount","value":"4"},{"name":"cdx:npm:maintainerOverlapRatio","value":"1.00"},{"name":"cdx:npm:maintainerSet","value":"doowb, brian.woodward@gmail.com, jonschlinkert, github@sellside.com"},{"name":"cdx:npm:maintainerSetCount","value":"4"},{"name":"cdx:npm:packageCreatedTime","value":"2014-09-26T08:08:38.913Z"},{"name":"cdx:npm:priorMaintainerSet","value":"doowb, brian.woodward@gmail.com, jonschlinkert, github@sellside.com"},{"name":"cdx:npm:priorMaintainerSetCount","value":"4"},{"name":"cdx:npm:priorPublishTime","value":"2017-12-01T18:31:27.385Z"},{"name":"cdx:npm:priorPublisher","value":"jonschlinkert"},{"name":"cdx:npm:priorVersion","value":"6.0.2"},{"name":"cdx:npm:publishTime","value":"2020-01-16T16:59:19.808Z"},{"name":"cdx:npm:publisher","value":"doowb"},{"name":"cdx:npm:publisherDrift","value":"true"},{"name":"cdx:npm:publisherEmail","value":"brian.woodward@gmail.com"},{"name":"cdx:npm:releaseCadenceCompressionRatio","value":"28.07"},{"name":"cdx:npm:releaseGapBaselineDays","value":"27.65"},{"name":"cdx:npm:releaseGapDays","value":"775.94"},{"name":"cdx:npm:releaseGapSampleSize","value":"25"},{"name":"cdx:npm:versionCount","value":"27"},{"name":"internal:ResolvedUrl","value":"https://registry.npmjs.org/kind-of/-/kind-of-6.0.3.tgz"},{"name":"internal:SrcFile","value":".cdxgen-work/npm-nonshipped-1792026955603/src/test/fixtures/app/package-lock.json"}],"evidence":{"identity":[{"field":"purl","confidence":1,"methods":[{"technique":"manifest-analysis","confidence":1,"value":".cdxgen-work/npm-nonshipped-1792026955603/src/test/fixtures/app/package-lock.json"}],"concludedValue":".cdxgen-work/npm-nonshipped-1792026955603/src/test/fixtures/app/package-lock.json"}]}},{"group":"","name":"left-pad","version":"1.3.0","description":"String left pad","hashes":[{"alg":"SHA-512","content":"5c8e4c3f354d0298c0ca1433a615fc06498ab0a5310f82ddc8adb88997901a29c137dc93413ddb165081cbf695c761eb35ca901ac768b7c821ae3cabbcc0a810"}],"licenses":[{"license":{"id":"WTFPL","url":"https://opensource.org/licenses/WTFPL","properties":[{"name":"cdx:license:category","value":"Public Domain"},{"name":"cdx:license:foss","value":"true"},{"name":"cdx:license:osiApproved","value":"false"},{"name":"cdx:license:fsfLibre","value":"true"},{"name":"cdx:license:deprecated","value":"false"}]}}],"purl":"pkg:npm/left-pad@1.3.0","externalReferences":[{"type":"distribution","url":"https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz"}],"type":"library","bom-ref":"pkg:npm/left-pad@1.3.0","properties":[{"name":"cdx:license:category","value":"Public Domain"},{"name":"cdx:npm:artifactIntegrity","value":"sha512-XI5MPzVNApjAyhQzphX8BkmKsKUxD4LdyK24iZeQGinBN9yTQT3bFlCBy/aVx2HrNcqQGsdot8ghrjyrvMCoEA=="},{"name":"cdx:npm:artifactShasum","value":"5b8a3a7765dfe001261dde915589e782f8c94d1e"},{"name":"cdx:npm:lastModifiedTime","value":"2024-04-16T05:01:57.431Z"},{"name":"cdx:npm:maintainerOverlapCount","value":"6"},{"name":"cdx:npm:maintainerOverlapRatio","value":"1.00"},{"name":"cdx:npm:maintainerSet","value":"sebmck, sebmck@gmail.com, stevemao, maochenyan@gmail.com, westlac, cameron.westland@autodesk.com"},{"name":"cdx:npm:maintainerSetCount","value":"6"},{"name":"cdx:npm:packageCreatedTime","value":"2014-03-14T09:09:20.762Z"},{"name":"cdx:npm:priorMaintainerSet","value":"sebmck, sebmck@gmail.com, stevemao, maochenyan@gmail.com, westlac, cameron.westland@autodesk.com"},{"name":"cdx:npm:priorMaintainerSetCount","value":"6"},{"name":"cdx:npm:priorPublishTime","value":"2017-11-17T05:48:38.934Z"},{"name":"cdx:npm:priorPublisher","value":"stevemao"},{"name":"cdx:npm:priorVersion","value":"1.2.0"},{"name":"cdx:npm:publishTime","value":"2018-04-09T01:10:45.796Z"},{"name":"cdx:npm:publisher","value":"stevemao"},{"name":"cdx:npm:publisherEmail","value":"maochenyan@gmail.com"},{"name":"cdx:npm:releaseCadenceCompressionRatio","value":"6.58"},{"name":"cdx:npm:releaseGapBaselineDays","value":"21.71"},{"name":"cdx:npm:releaseGapDays","value":"142.81"},{"name":"cdx:npm:releaseGapSampleSize","value":"13"},{"name":"cdx:npm:versionCount","value":"15"},{"name":"internal:ResolvedUrl","value":"https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz"},{"name":"internal:SrcFile","value":".cdxgen-work/npm-nonshipped-1792026955603/src/examples/demo/package-lock.json"}],"evidence":{"identity":[{"field":"purl","confidence":1,"methods":[{"technique":"manifest-analysis","confidence":1,"value":".cdxgen-work/npm-nonshipped-1792026955603/src/examples/demo/package-lock.json"}],"concludedValue":".cdxgen-work/npm-nonshipped-1792026955603/src/examples/demo/package-lock.json"}]}}],"services":[],"dependencies":[{"ref":"pkg:npm/ms@2.1.2","dependsOn":[]},{"ref":"pkg:npm/debug@4.3.4","dependsOn":["pkg:npm/ms@2.1.2"]},{"ref":"pkg:npm/is-number@7.0.0","dependsOn":[]},{"ref":"pkg:npm/scab-npm-nonshipped@1.0.0","dependsOn":["pkg:npm/debug@4.3.4","pkg:npm/is-number@7.0.0","pkg:npm/scab-example-demo@0.0.0","pkg:npm/scab-test-fixture-app@0.0.0"]},{"ref":"pkg:npm/kind-of@6.0.3","dependsOn":[]},{"ref":"pkg:npm/scab-test-fixture-app@0.0.0","dependsOn":["pkg:npm/kind-of@6.0.3"]},{"ref":"pkg:npm/left-pad@1.3.0","dependsOn":[]},{"ref":"pkg:npm/scab-example-demo@0.0.0","dependsOn":["pkg:npm/left-pad@1.3.0"]}],"annotations":[{"bom-ref":"metadata-annotations","subjects":["pkg:npm/scab-npm-nonshipped@1.0.0"],"annotator":{"component":{"group":"@cdxgen","name":"cdxgen","version":"13.4.0","purl":"pkg:npm/%40cdxgen/cdxgen@13.4.0","type":"application","bom-ref":"pkg:npm/@cdxgen/cdxgen@13.4.0","publisher":"OWASP Foundation","authors":[{"name":"OWASP Foundation"}]}},"timestamp":"2026-10-15T01:15:57Z","text":"This Software Bill-of-Materials (SBOM) document was created on Thursday, October 15, 2026 with cdxgen. The data was captured during the build lifecycle phase. The document describes an application named 'scab-npm-nonshipped' with version '1.0.0'. The application also has 2 child modules/components."}]}