{"$schema":"http://cyclonedx.org/schema/bom-1.7.schema.json","bomFormat":"CycloneDX","specVersion":"1.7","serialNumber":"urn:uuid:077f86df-b7ca-46f8-b339-feae79f54d17","version":1,"metadata":{"timestamp":"2026-10-15T10:16:37+09:00","tools":{"components":[{"type":"application","author":"anchore","name":"syft","version":"1.54.1"}]},"component":{"bom-ref":"626dfd336a68a6b8","type":"file","name":"~/projects/sca-benchmark-wt/refresh-latest/fixtures/npm-vuln-pinned"}},"components":[{"bom-ref":"pkg:npm/lodash@4.17.15?package-id=0b98b707a64f3042","type":"library","name":"lodash","version":"4.17.15","cpe":"cpe:2.3:a:lodash:lodash:4.17.15:*:*:*:*:node.js:*:*","purl":"pkg:npm/lodash@4.17.15","properties":[{"name":"syft:package:foundBy","value":"javascript-lock-cataloger"},{"name":"syft:package:language","value":"javascript"},{"name":"syft:package:type","value":"npm"},{"name":"syft:package:metadataType","value":"javascript-npm-package-lock-entry"},{"name":"syft:location:0:path","value":"/package-lock.json"}]},{"bom-ref":"pkg:npm/vuln-pinned@1.0.0?package-id=05131572c60dc826","type":"library","name":"vuln-pinned","version":"1.0.0","cpe":"cpe:2.3:a:vuln-pinned:vuln-pinned:1.0.0:*:*:*:*:*:*:*","purl":"pkg:npm/vuln-pinned@1.0.0","properties":[{"name":"syft:package:foundBy","value":"javascript-lock-cataloger"},{"name":"syft:package:language","value":"javascript"},{"name":"syft:package:type","value":"npm"},{"name":"syft:package:metadataType","value":"javascript-npm-package-lock-entry"},{"name":"syft:cpe23","value":"cpe:2.3:a:vuln-pinned:vuln_pinned:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:vuln_pinned:vuln-pinned:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:vuln_pinned:vuln_pinned:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:vuln:vuln-pinned:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:vuln:vuln_pinned:1.0.0:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/package-lock.json"}]},{"bom-ref":"fd71c2238fc07657","type":"file","name":"~/projects/sca-benchmark-wt/refresh-latest/fixtures/npm-vuln-pinned/package-lock.json","hashes":[{"alg":"SHA-1","content":"394c2ba19dfc377a0002bf92edd048c49a5cf4d2"},{"alg":"SHA-256","content":"2b2cafbfdb87c9464b871e2278c128caaae9f0f5e7c46609f32f2905de5ccf67"}]}],"dependencies":[{"ref":"pkg:npm/vuln-pinned@1.0.0?package-id=05131572c60dc826","dependsOn":["pkg:npm/lodash@4.17.15?package-id=0b98b707a64f3042"]}]}