{"bomFormat":"CycloneDX","specVersion":"1.6","serialNumber":"urn:uuid:e85a8a6e-f11d-4d85-a51f-89c048a8a732","version":1,"metadata":{"timestamp":"2026-10-15T01:16:40Z","tools":{"components":[{"group":"@cdxgen","name":"cdxgen","version":"13.4.0","purl":"pkg:npm/%40cdxgen/cdxgen@13.4.0","type":"application","bom-ref":"pkg:npm/@cdxgen/cdxgen@13.4.0","publisher":"OWASP Foundation","authors":[{"name":"OWASP Foundation"}]}]},"authors":[{"name":"OWASP Foundation"}],"lifecycles":[{"phase":"build"}],"component":{"name":"vuln-pinned","group":"","version":"1.0.0","description":"SCA 벤치마크 fixture — 취약 버전 고정으로 취약점 precision 측정","purl":"pkg:npm/vuln-pinned@1.0.0","bom-ref":"pkg:npm/vuln-pinned@1.0.0","properties":[],"type":"application"},"properties":[{"name":"cdx:bom:componentSrcFiles","value":".cdxgen-work/npm-vuln-pinned-1792026998947/src/package-lock.json"},{"name":"cdx:bom:componentTypes","value":"npm"}]},"components":[{"group":"","name":"lodash","version":"4.17.15","description":"Lodash modular utilities.","hashes":[{"alg":"SHA-512","content":"f3139c447bc28e7a1c752e5ca705d05d5ce69a1e5ee7eb1a136406a1e4266ca9914ba277550a693ce22dd0c9e613ee31959a2e9b2d063c6d03d0c54841b340d4"}],"licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:license:foss","value":"true"},{"name":"cdx:license:osiApproved","value":"true"},{"name":"cdx:license:fsfLibre","value":"true"},{"name":"cdx:license:deprecated","value":"false"}]}}],"purl":"pkg:npm/lodash@4.17.15","externalReferences":[{"type":"distribution","url":"https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz"}],"type":"library","bom-ref":"pkg:npm/lodash@4.17.15","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:npm:artifactIntegrity","value":"sha512-8xOcRHvCjnocdS5cpwXQXVzmmh5e5+saE2QGoeQmbKmRS6J3VQppPOIt0MnmE+4xlZoumy0GPG0D0MVIQbNA1A=="},{"name":"cdx:npm:artifactShasum","value":"b447f6670a0455bbfeedd11392eff330ea097548"},{"name":"cdx:npm:lastModifiedTime","value":"2026-10-15T00:52:12.345Z"},{"name":"cdx:npm:maintainerOverlapCount","value":"4"},{"name":"cdx:npm:maintainerOverlapRatio","value":"1.00"},{"name":"cdx:npm:maintainerSet","value":"jdalton, john.david.dalton@gmail.com, mathias, mathias@qiwi.be"},{"name":"cdx:npm:maintainerSetCount","value":"4"},{"name":"cdx:npm:packageCreatedTime","value":"2012-04-23T16:37:11.912Z"},{"name":"cdx:npm:priorMaintainerSet","value":"jdalton, john.david.dalton@gmail.com, mathias, mathias@qiwi.be"},{"name":"cdx:npm:priorMaintainerSetCount","value":"4"},{"name":"cdx:npm:priorPublishTime","value":"2019-07-10T15:44:39.173Z"},{"name":"cdx:npm:priorPublisher","value":"jdalton"},{"name":"cdx:npm:priorVersion","value":"4.17.14"},{"name":"cdx:npm:publishTime","value":"2019-07-19T02:28:46.584Z"},{"name":"cdx:npm:publisher","value":"jdalton"},{"name":"cdx:npm:publisherEmail","value":"john.david.dalton@gmail.com"},{"name":"cdx:npm:releaseCadenceCompressionRatio","value":"1.78"},{"name":"cdx:npm:releaseGapBaselineDays","value":"4.74"},{"name":"cdx:npm:releaseGapDays","value":"8.45"},{"name":"cdx:npm:releaseGapSampleSize","value":"106"},{"name":"cdx:npm:versionCount","value":"117"},{"name":"internal:ResolvedUrl","value":"https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz"},{"name":"internal:SrcFile","value":".cdxgen-work/npm-vuln-pinned-1792026998947/src/package-lock.json"}],"evidence":{"identity":[{"field":"purl","confidence":1,"methods":[{"technique":"manifest-analysis","confidence":1,"value":".cdxgen-work/npm-vuln-pinned-1792026998947/src/package-lock.json"}],"concludedValue":".cdxgen-work/npm-vuln-pinned-1792026998947/src/package-lock.json"}]}}],"services":[],"dependencies":[{"ref":"pkg:npm/lodash@4.17.15","dependsOn":[]},{"ref":"pkg:npm/vuln-pinned@1.0.0","dependsOn":["pkg:npm/lodash@4.17.15"]}],"annotations":[{"bom-ref":"metadata-annotations","subjects":["pkg:npm/vuln-pinned@1.0.0"],"annotator":{"component":{"group":"@cdxgen","name":"cdxgen","version":"13.4.0","purl":"pkg:npm/%40cdxgen/cdxgen@13.4.0","type":"application","bom-ref":"pkg:npm/@cdxgen/cdxgen@13.4.0","publisher":"OWASP Foundation","authors":[{"name":"OWASP Foundation"}]}},"timestamp":"2026-10-15T01:16:40Z","text":"This Software Bill-of-Materials (SBOM) document was created on Thursday, October 15, 2026 with cdxgen. The data was captured during the build lifecycle phase. The document describes an application named 'vuln-pinned' with version '1.0.0'."}]}