{"$schema":"http://cyclonedx.org/schema/bom-1.7.schema.json","bomFormat":"CycloneDX","specVersion":"1.7","serialNumber":"urn:uuid:6f4fbf93-aee7-4f1b-a204-3bac2e82ee4f","version":1,"metadata":{"timestamp":"2026-10-15T10:15:54+09:00","tools":{"components":[{"type":"application","author":"anchore","name":"syft","version":"1.54.1"}]},"component":{"bom-ref":"2c93ab7e943c4456","type":"file","name":"~/projects/sca-benchmark-wt/refresh-latest/fixtures/npm-nonshipped"}},"components":[{"bom-ref":"pkg:npm/debug@4.3.4?package-id=2514af8dcf4f104d","type":"library","name":"debug","version":"4.3.4","licenses":[{"license":{"id":"MIT"}}],"cpe":"cpe:2.3:a:debug_project:debug:4.3.4:*:*:*:*:node.js:*:*","purl":"pkg:npm/debug@4.3.4","properties":[{"name":"syft:package:foundBy","value":"javascript-lock-cataloger"},{"name":"syft:package:language","value":"javascript"},{"name":"syft:package:type","value":"npm"},{"name":"syft:package:metadataType","value":"javascript-npm-package-lock-entry"},{"name":"syft:location:0:path","value":"/package-lock.json"}]},{"bom-ref":"pkg:npm/kind-of@6.0.3?package-id=ca49312a2715486a","type":"library","name":"kind-of","version":"6.0.3","licenses":[{"license":{"id":"MIT"}}],"cpe":"cpe:2.3:a:kind-of:kind-of:6.0.3:*:*:*:*:*:*:*","purl":"pkg:npm/kind-of@6.0.3","properties":[{"name":"syft:package:foundBy","value":"javascript-lock-cataloger"},{"name":"syft:package:language","value":"javascript"},{"name":"syft:package:type","value":"npm"},{"name":"syft:package:metadataType","value":"javascript-npm-package-lock-entry"},{"name":"syft:cpe23","value":"cpe:2.3:a:kind-of:kind_of:6.0.3:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:kind_of:kind-of:6.0.3:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:kind_of:kind_of:6.0.3:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:kind:kind-of:6.0.3:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:kind:kind_of:6.0.3:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/test/fixtures/app/package-lock.json"}]},{"bom-ref":"pkg:npm/left-pad@1.3.0?package-id=a8db6bfad3e9c663","type":"library","name":"left-pad","version":"1.3.0","licenses":[{"license":{"id":"WTFPL"}}],"cpe":"cpe:2.3:a:left-pad:left-pad:1.3.0:*:*:*:*:*:*:*","purl":"pkg:npm/left-pad@1.3.0","properties":[{"name":"syft:package:foundBy","value":"javascript-lock-cataloger"},{"name":"syft:package:language","value":"javascript"},{"name":"syft:package:type","value":"npm"},{"name":"syft:package:metadataType","value":"javascript-npm-package-lock-entry"},{"name":"syft:cpe23","value":"cpe:2.3:a:left-pad:left_pad:1.3.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:left_pad:left-pad:1.3.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:left_pad:left_pad:1.3.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:left:left-pad:1.3.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:left:left_pad:1.3.0:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/examples/demo/package-lock.json"}]},{"bom-ref":"pkg:npm/ms@2.1.2?package-id=99566b592187a2c5","type":"library","name":"ms","version":"2.1.2","licenses":[{"license":{"id":"MIT"}}],"cpe":"cpe:2.3:a:vercel:ms:2.1.2:*:*:*:*:node.js:*:*","purl":"pkg:npm/ms@2.1.2","properties":[{"name":"syft:package:foundBy","value":"javascript-lock-cataloger"},{"name":"syft:package:language","value":"javascript"},{"name":"syft:package:type","value":"npm"},{"name":"syft:package:metadataType","value":"javascript-npm-package-lock-entry"},{"name":"syft:location:0:path","value":"/package-lock.json"}]},{"bom-ref":"pkg:npm/scab-example-demo@0.0.0?package-id=9db78da6e0d5746e","type":"library","name":"scab-example-demo","version":"0.0.0","cpe":"cpe:2.3:a:scab-example-demo:scab-example-demo:0.0.0:*:*:*:*:*:*:*","purl":"pkg:npm/scab-example-demo@0.0.0","properties":[{"name":"syft:package:foundBy","value":"javascript-lock-cataloger"},{"name":"syft:package:language","value":"javascript"},{"name":"syft:package:type","value":"npm"},{"name":"syft:package:metadataType","value":"javascript-npm-package-lock-entry"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab-example-demo:scab_example_demo:0.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab_example_demo:scab-example-demo:0.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab_example_demo:scab_example_demo:0.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab-example:scab-example-demo:0.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab-example:scab_example_demo:0.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab_example:scab-example-demo:0.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab_example:scab_example_demo:0.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab:scab-example-demo:0.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab:scab_example_demo:0.0.0:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/examples/demo/package-lock.json"}]},{"bom-ref":"pkg:npm/scab-npm-nonshipped@1.0.0?package-id=ac6a45878d2285bf","type":"library","name":"scab-npm-nonshipped","version":"1.0.0","cpe":"cpe:2.3:a:scab-npm-nonshipped:scab-npm-nonshipped:1.0.0:*:*:*:*:*:*:*","purl":"pkg:npm/scab-npm-nonshipped@1.0.0","properties":[{"name":"syft:package:foundBy","value":"javascript-lock-cataloger"},{"name":"syft:package:language","value":"javascript"},{"name":"syft:package:type","value":"npm"},{"name":"syft:package:metadataType","value":"javascript-npm-package-lock-entry"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab-npm-nonshipped:scab_npm_nonshipped:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab_npm_nonshipped:scab-npm-nonshipped:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab_npm_nonshipped:scab_npm_nonshipped:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab-npm:scab-npm-nonshipped:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab-npm:scab_npm_nonshipped:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab_npm:scab-npm-nonshipped:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab_npm:scab_npm_nonshipped:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab:scab-npm-nonshipped:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab:scab_npm_nonshipped:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/package-lock.json"}]},{"bom-ref":"pkg:npm/scab-test-fixture-app@0.0.0?package-id=b46a602cb0d929c6","type":"library","name":"scab-test-fixture-app","version":"0.0.0","cpe":"cpe:2.3:a:scab-test-fixture-app:scab-test-fixture-app:0.0.0:*:*:*:*:*:*:*","purl":"pkg:npm/scab-test-fixture-app@0.0.0","properties":[{"name":"syft:package:foundBy","value":"javascript-lock-cataloger"},{"name":"syft:package:language","value":"javascript"},{"name":"syft:package:type","value":"npm"},{"name":"syft:package:metadataType","value":"javascript-npm-package-lock-entry"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab-test-fixture-app:scab_test_fixture_app:0.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab_test_fixture_app:scab-test-fixture-app:0.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab_test_fixture_app:scab_test_fixture_app:0.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab-test-fixture:scab-test-fixture-app:0.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab-test-fixture:scab_test_fixture_app:0.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab_test_fixture:scab-test-fixture-app:0.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab_test_fixture:scab_test_fixture_app:0.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab-test:scab-test-fixture-app:0.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab-test:scab_test_fixture_app:0.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab_test:scab-test-fixture-app:0.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab_test:scab_test_fixture_app:0.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab:scab-test-fixture-app:0.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:scab:scab_test_fixture_app:0.0.0:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/test/fixtures/app/package-lock.json"}]},{"bom-ref":"60028869c49a1def","type":"file","name":"~/projects/sca-benchmark-wt/refresh-latest/fixtures/npm-nonshipped/examples/demo/package-lock.json","hashes":[{"alg":"SHA-1","content":"15115bc395ae050c117b012e106dbc6899198dae"},{"alg":"SHA-256","content":"35af294fdb7ebae3c1f6f4036ceb08d0ed29095df736de6fccedb1343b791ff2"}]},{"bom-ref":"fd71c2238fc07657","type":"file","name":"~/projects/sca-benchmark-wt/refresh-latest/fixtures/npm-nonshipped/package-lock.json","hashes":[{"alg":"SHA-1","content":"b2b0044a0d26ea22ebfec257670d9017786f8768"},{"alg":"SHA-256","content":"0e409c38369e0fb4eb4fd30e40a8b63b6f4e2b0dc9150915ba45597875935d0d"}]},{"bom-ref":"23a57103df451f7d","type":"file","name":"~/projects/sca-benchmark-wt/refresh-latest/fixtures/npm-nonshipped/test/fixtures/app/package-lock.json","hashes":[{"alg":"SHA-1","content":"9bb1f1c914c5ba99b8f0071294f20ceeb244161c"},{"alg":"SHA-256","content":"f4997f2009eb57645f08bd980eab983c6d6266ceacb38b084e9042dea5acb4b6"}]}],"dependencies":[{"ref":"pkg:npm/debug@4.3.4?package-id=2514af8dcf4f104d","dependsOn":["pkg:npm/ms@2.1.2?package-id=99566b592187a2c5"]},{"ref":"pkg:npm/scab-example-demo@0.0.0?package-id=9db78da6e0d5746e","dependsOn":["pkg:npm/left-pad@1.3.0?package-id=a8db6bfad3e9c663"]},{"ref":"pkg:npm/scab-npm-nonshipped@1.0.0?package-id=ac6a45878d2285bf","dependsOn":["pkg:npm/debug@4.3.4?package-id=2514af8dcf4f104d"]},{"ref":"pkg:npm/scab-test-fixture-app@0.0.0?package-id=b46a602cb0d929c6","dependsOn":["pkg:npm/kind-of@6.0.3?package-id=ca49312a2715486a"]}]}