{"bom":{"annotations":[{"annotator":{"component":{"authors":[{"name":"OWASP Foundation"}],"bom-ref":"pkg:npm/@cdxgen/cdxgen@13.3.0","group":"@cdxgen","name":"cdxgen","publisher":"OWASP Foundation","purl":"pkg:npm/%40cdxgen/cdxgen@13.3.0","type":"application","version":"13.3.0"}},"bom-ref":"metadata-annotations","subjects":["pkg:npm/scab-pnpm-workspace@1.0.0"],"text":"This Software Bill-of-Materials (SBOM) document was created on Wednesday, October 14, 2026 with cdxgen. The data was captured during the build lifecycle phase. The document describes an application named 'scab-pnpm-workspace' with version '1.0.0'. The application also has 2 child modules/components.","timestamp":"2026-10-14T22:59:51Z"}],"bomFormat":"CycloneDX","components":[{"bom-ref":"pkg:npm/debug@4.3.4","description":"Lightweight debugging utility for Node.js and the browser","evidence":{"identity":[{"concludedValue":"pnpm-lock.yaml","confidence":1,"field":"purl","methods":[{"confidence":1,"technique":"manifest-analysis","value":"pnpm-lock.yaml"}]}]},"externalReferences":[{"type":"distribution","url":"https://registry.npmjs.org/debug/-/debug-4.3.4.tgz"}],"group":"","hashes":[{"alg":"SHA-512","content":"3d15851ee494dde0ed4093ef9cd63b25c91eb758f4b793ae3ac1733cfcec7a40f9d9997ca947c520f122b305ea22f1d61951ce817fbb1bfbc234d85e870c5f91"}],"licenses":[{"license":{"id":"MIT","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:license:foss","value":"true"},{"name":"cdx:license:osiApproved","value":"true"},{"name":"cdx:license:fsfLibre","value":"true"},{"name":"cdx:license:deprecated","value":"false"}],"url":"https://opensource.org/licenses/MIT"}}],"name":"debug","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:npm:artifactIntegrity","value":"sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ=="},{"name":"cdx:npm:artifactShasum","value":"1319f6579357f2338d3337d2cdd4914bb5dcc865"},{"name":"cdx:npm:lastModifiedTime","value":"2025-09-13T17:25:19.913Z"},{"name":"cdx:npm:maintainerOverlapCount","value":"8"},{"name":"cdx:npm:maintainerOverlapRatio","value":"1.00"},{"name":"cdx:npm:maintainerSet","value":"qix, josh@junon.me, thebigredgeek, rhyneandrew@gmail.com, tootallnate, nathan@tootallnate.net, tjholowaychuk, tj@vision-media.ca"},{"name":"cdx:npm:maintainerSetCount","value":"8"},{"name":"cdx:npm:packageCreatedTime","value":"2011-11-29T01:11:23.618Z"},{"name":"cdx:npm:package_json","value":"/app/packages/app/package.json"},{"name":"cdx:npm:priorMaintainerSet","value":"qix, josh@junon.me, thebigredgeek, rhyneandrew@gmail.com, tootallnate, nathan@tootallnate.net, tjholowaychuk, tj@vision-media.ca"},{"name":"cdx:npm:priorMaintainerSetCount","value":"8"},{"name":"cdx:npm:priorPublishTime","value":"2021-11-27T13:14:24.425Z"},{"name":"cdx:npm:priorPublisher","value":"qix"},{"name":"cdx:npm:priorVersion","value":"4.3.3"},{"name":"cdx:npm:publishTime","value":"2022-03-17T13:38:47.641Z"},{"name":"cdx:npm:publisher","value":"qix"},{"name":"cdx:npm:publisherEmail","value":"josh@junon.me"},{"name":"cdx:npm:releaseCadenceCompressionRatio","value":"11.51"},{"name":"cdx:npm:releaseGapBaselineDays","value":"9.56"},{"name":"cdx:npm:releaseGapDays","value":"110.02"},{"name":"cdx:npm:releaseGapSampleSize","value":"69"},{"name":"cdx:npm:versionCount","value":"78"},{"name":"internal:SrcFile","value":"pnpm-lock.yaml"},{"name":"internal:workspaceRef","value":"pkg:npm/@scab/app@1.0.0"},{"name":"internal:workspaceSrcFile","value":"packages/app/package.json"},{"name":"bomlens:licenseClass","value":"permissive"}],"purl":"pkg:npm/debug@4.3.4","type":"library","version":"4.3.4"},{"bom-ref":"pkg:npm/kind-of@6.0.3","description":"Get the native type of a value.","evidence":{"identity":[{"concludedValue":"pnpm-lock.yaml","confidence":1,"field":"purl","methods":[{"confidence":1,"technique":"manifest-analysis","value":"pnpm-lock.yaml"}]}]},"externalReferences":[{"type":"distribution","url":"https://registry.npmjs.org/kind-of/-/kind-of-6.0.3.tgz"}],"group":"","hashes":[{"alg":"SHA-512","content":"75c4b5ba5fbdb66783f794fec76f3f7a12e077d98435adcbb2f0d3b739b7bf20443bb44fa6dbc00feb78e165576948d305172ba45785942f160abb94478e7a87"}],"licenses":[{"license":{"id":"MIT","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:license:foss","value":"true"},{"name":"cdx:license:osiApproved","value":"true"},{"name":"cdx:license:fsfLibre","value":"true"},{"name":"cdx:license:deprecated","value":"false"}],"url":"https://opensource.org/licenses/MIT"}}],"name":"kind-of","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:npm:artifactIntegrity","value":"sha512-dcS1ul+9tmeD95T+x28/ehLgd9mENa3LsvDTtzm3vyBEO7RPptvAD+t44WVXaUjTBRcrpFeFlC8WCruUR456hw=="},{"name":"cdx:npm:artifactShasum","value":"07c05034a6c349fa06e24fa35aa76db4580ce4dd"},{"name":"cdx:npm:lastModifiedTime","value":"2023-07-12T19:12:21.548Z"},{"name":"cdx:npm:maintainerOverlapCount","value":"4"},{"name":"cdx:npm:maintainerOverlapRatio","value":"1.00"},{"name":"cdx:npm:maintainerSet","value":"doowb, brian.woodward@gmail.com, jonschlinkert, github@sellside.com"},{"name":"cdx:npm:maintainerSetCount","value":"4"},{"name":"cdx:npm:packageCreatedTime","value":"2014-09-26T08:08:38.913Z"},{"name":"cdx:npm:package_json","value":"/app/packages/util/package.json"},{"name":"cdx:npm:priorMaintainerSet","value":"doowb, brian.woodward@gmail.com, jonschlinkert, github@sellside.com"},{"name":"cdx:npm:priorMaintainerSetCount","value":"4"},{"name":"cdx:npm:priorPublishTime","value":"2017-12-01T18:31:27.385Z"},{"name":"cdx:npm:priorPublisher","value":"jonschlinkert"},{"name":"cdx:npm:priorVersion","value":"6.0.2"},{"name":"cdx:npm:publishTime","value":"2020-01-16T16:59:19.808Z"},{"name":"cdx:npm:publisher","value":"doowb"},{"name":"cdx:npm:publisherDrift","value":"true"},{"name":"cdx:npm:publisherEmail","value":"brian.woodward@gmail.com"},{"name":"cdx:npm:releaseCadenceCompressionRatio","value":"28.07"},{"name":"cdx:npm:releaseGapBaselineDays","value":"27.65"},{"name":"cdx:npm:releaseGapDays","value":"775.94"},{"name":"cdx:npm:releaseGapSampleSize","value":"25"},{"name":"cdx:npm:versionCount","value":"27"},{"name":"internal:SrcFile","value":"pnpm-lock.yaml"},{"name":"internal:workspaceRef","value":"pkg:npm/@scab/util@1.0.0"},{"name":"internal:workspaceSrcFile","value":"packages/util/package.json"},{"name":"bomlens:licenseClass","value":"permissive"}],"purl":"pkg:npm/kind-of@6.0.3","type":"library","version":"6.0.3"},{"bom-ref":"pkg:npm/ms@2.1.2","description":"Tiny millisecond conversion utility","evidence":{"identity":[{"concludedValue":"pnpm-lock.yaml","confidence":1,"field":"purl","methods":[{"confidence":1,"technique":"manifest-analysis","value":"pnpm-lock.yaml"}]}]},"externalReferences":[{"type":"distribution","url":"https://registry.npmjs.org/ms/-/ms-2.1.2.tgz"}],"group":"","hashes":[{"alg":"SHA-512","content":"b0690fc7e56332d980e8c5f6ee80381411442c50996784b85ea7863970afebcb53fa36f7be4fd1c9a2963f43d32b25ad98b48cd1bf9a7544c4bdbb353c4687db"}],"licenses":[{"license":{"id":"MIT","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:license:foss","value":"true"},{"name":"cdx:license:osiApproved","value":"true"},{"name":"cdx:license:fsfLibre","value":"true"},{"name":"cdx:license:deprecated","value":"false"}],"url":"https://opensource.org/licenses/MIT"}}],"name":"ms","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:npm:artifactIntegrity","value":"sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w=="},{"name":"cdx:npm:artifactShasum","value":"d09d1f357b443f493382a8eb3ccd183872ae6009"},{"name":"cdx:npm:lastModifiedTime","value":"2025-09-08T19:56:54.242Z"},{"name":"cdx:npm:maintainerOverlapCount","value":"4"},{"name":"cdx:npm:maintainerOverlapRatio","value":"0.04"},{"name":"cdx:npm:maintainerSet","value":"alexaltea, alexandro@phi.nz, anatrajkovska, ana.trajkovska2015@gmail.com, andybitz, artzbitz@gmail.com, arunoda, arunoda.susiripala@gmail.com, arzafran, franco@basement.studio, atcastle, atcastle@gmail.com, b3nnyl, ciao@sylin.me, caarlos0, caarlos0@gmail.com, codetheory, thecodetheory@gmail.com, coetry, allenhai03@gmail.com, dav-is, mail@connordav.is, fivepointseven, fivepointseven@icloud.com, guybedford, guybedford@gmail.com, hharnisc, hharnisc@gmail.com, huvik, lukas@huvar.cz, iamevilrabbit, hello@evilrabb.it, igorklopov, igor@klopov.com, ijjk, jj@jjsweb.site, janicklas-ralph, janicklasralph036@gmail.com, javivelasco, javier.velasco86@gmail.com, joecohens, joecohenr@gmail.com, juancampa, juancampa@gmail.com, leo, leo@zeit.co, lfades, luisito453@gmail.com, lucleray, luc.leray@gmail.com, manovotny, manovotny@gmail.com, marcosnils, marcosnils@gmail.com, matheuss, me@matheus.top, mfix22, mrfix84@gmail.com, mglagola, mark.glagola@gmail.com, msweeneydev, mail@msweeneydev.com, nkzawa, naoyuki.kanezawa@gmail.com, olliv, olli@zeit.co, paco, pvco.coursey@gmail.com, paulogdm, paulogdemitri@gmail.com, quietshu, ds303077135@gmail.com, rabaut, rabautse@gmail.com, ragojose, ragojosefrancisco@gmail.com, rauchg, rauchg@gmail.com, sarupbanskota, sbanskota08@gmail.com, skllcrn, skllcrn@zeit.co, sophearak, t.sophearak@gmail.com, styfle, steven@ceriously.com, timer, timer150@gmail.com, timneutkens, tim@timneutkens.nl, tootallnate, nathan@tootallnate.net, umegaya, iyatomi@gmail.com, williamli, williamli@bbi.io, zeit-bot, team@zeit.co"},{"name":"cdx:npm:maintainerSetCount","value":"98"},{"name":"cdx:npm:maintainerSetPartialDrift","value":"true"},{"name":"cdx:npm:packageCreatedTime","value":"2011-12-21T19:38:08.664Z"},{"name":"cdx:npm:priorMaintainerSet","value":"leo, leo@zeit.co, rauchg, rauchg@gmail.com"},{"name":"cdx:npm:priorMaintainerSetCount","value":"4"},{"name":"cdx:npm:priorPublishTime","value":"2017-11-30T18:30:16.876Z"},{"name":"cdx:npm:priorPublisher","value":"leo"},{"name":"cdx:npm:priorVersion","value":"2.1.1"},{"name":"cdx:npm:publishTime","value":"2019-06-06T17:31:55.859Z"},{"name":"cdx:npm:publisher","value":"styfle"},{"name":"cdx:npm:publisherDrift","value":"true"},{"name":"cdx:npm:publisherEmail","value":"steven@ceriously.com"},{"name":"cdx:npm:releaseCadenceCompressionRatio","value":"6.73"},{"name":"cdx:npm:releaseGapBaselineDays","value":"82.22"},{"name":"cdx:npm:releaseGapDays","value":"552.96"},{"name":"cdx:npm:releaseGapSampleSize","value":"16"},{"name":"cdx:npm:versionCount","value":"32"},{"name":"internal:SrcFile","value":"pnpm-lock.yaml"},{"name":"internal:workspaceRef","value":"pkg:npm/@scab/app@1.0.0"},{"name":"internal:workspaceSrcFile","value":"packages/app/package.json"},{"name":"bomlens:licenseClass","value":"permissive"}],"purl":"pkg:npm/ms@2.1.2","tags":["cloud","icloud"],"type":"library","version":"2.1.2"}],"dependencies":[{"dependsOn":["pkg:npm/@scab/util@1.0.0","pkg:npm/debug@4.3.4"],"ref":"pkg:npm/@scab/app@1.0.0"},{"dependsOn":["pkg:npm/kind-of@6.0.3"],"ref":"pkg:npm/@scab/util@1.0.0"},{"dependsOn":["pkg:npm/@scab/app@1.0.0","pkg:npm/@scab/util@1.0.0"],"ref":"pkg:npm/scab-pnpm-workspace@1.0.0"},{"dependsOn":["pkg:npm/ms@2.1.2"],"ref":"pkg:npm/debug@4.3.4"},{"dependsOn":[],"ref":"pkg:npm/kind-of@6.0.3"},{"dependsOn":[],"ref":"pkg:npm/ms@2.1.2"}],"metadata":{"component":{"bom-ref":"pkg:npm/scab-pnpm-workspace@1.0.0","components":[{"bom-ref":"pkg:npm/@scab/app@1.0.0","group":"@scab","name":"app","properties":[{"name":"internal:SrcFile","value":"packages/app/package.json"},{"name":"internal:is_workspace","value":"true"},{"name":"internal:virtual_path","value":"packages/app"}],"purl":"pkg:npm/%40scab/app@1.0.0","type":"application","version":"1.0.0"},{"bom-ref":"pkg:npm/@scab/util@1.0.0","group":"@scab","name":"util","properties":[{"name":"internal:SrcFile","value":"packages/util/package.json"},{"name":"internal:is_workspace","value":"true"},{"name":"internal:virtual_path","value":"packages/util"}],"purl":"pkg:npm/%40scab/util@1.0.0","type":"application","version":"1.0.0"}],"group":"","name":"pnpm-workspace","properties":[{"name":"bomlens:source:versionPinning","value":"pinned"}],"type":"application","version":"1.0.0"},"lifecycles":[{"phase":"pre-build"}],"properties":[{"name":"cdx:bom:componentSrcFiles","value":"pnpm-lock.yaml"},{"name":"cdx:bom:componentTypes","value":"npm"},{"name":"bomlens:excluded-components","value":"pkg:npm/is-number@7.0.0"},{"name":"bomlens:excluded-paths","value":"**/test/**, **/tests/**, **/spec/**, **/fixtures/**, **/testdata/**, **/__tests__/**, **/e2e/**, **/example/**, **/examples/**, **/sample/**, **/samples/**, **/bench/**, **/benches/**, **/benchmark/**, **/benchmarks/**, **/demo/**, **/demos/**, **/playground/**, **/.github/workflows/**, **/gradle/wrapper/**"},{"name":"bomlens:undeclared-fields","value":"unknown-to-author"}],"timestamp":"2026-10-14T22:59:51Z","tools":{"components":[{"authors":[{"name":"OWASP Foundation"}],"bom-ref":"pkg:npm/@cdxgen/cdxgen@13.3.0","group":"@cdxgen","name":"cdxgen","publisher":"OWASP Foundation","purl":"pkg:npm/%40cdxgen/cdxgen@13.3.0","type":"application","version":"13.3.0"},{"name":"BomLens","publisher":"SK Telecom","type":"application","version":"1.13.4"}]}},"serialNumber":"urn:uuid:46069eb3-b5fb-45fd-aafb-eb322a2a5a61","services":[],"specVersion":"1.6","version":1,"compositions":[{"aggregate":"unknown"}]},"security":{"SchemaVersion":2,"Trivy":{"Version":"0.75.0"},"ReportID":"01a13ca5-30a0-73d5-bb30-bfa39ccb9ba1","CreatedAt":"2026-10-14T23:00:21.280252559Z","ArtifactName":"pnpm-workspace_1.0.0_bom.json","ArtifactType":"cyclonedx","Results":[{"Target":"Node.js","Class":"lang-pkgs","Type":"node-pkg","Packages":[{"ID":"debug@4.3.4","Name":"debug","Identifier":{"PURL":"pkg:npm/debug@4.3.4","UID":"b2672cdbabef3c81","BOMRef":"pkg:npm/debug@4.3.4"},"Version":"4.3.4","Licenses":["MIT"],"DependsOn":["ms@2.1.2"],"Digest":"sha512:3d15851ee494dde0ed4093ef9cd63b25c91eb758f4b793ae3ac1733cfcec7a40f9d9997ca947c520f122b305ea22f1d61951ce817fbb1bfbc234d85e870c5f91"},{"ID":"kind-of@6.0.3","Name":"kind-of","Identifier":{"PURL":"pkg:npm/kind-of@6.0.3","UID":"1e219918851bb500","BOMRef":"pkg:npm/kind-of@6.0.3"},"Version":"6.0.3","Licenses":["MIT"],"Digest":"sha512:75c4b5ba5fbdb66783f794fec76f3f7a12e077d98435adcbb2f0d3b739b7bf20443bb44fa6dbc00feb78e165576948d305172ba45785942f160abb94478e7a87"},{"ID":"ms@2.1.2","Name":"ms","Identifier":{"PURL":"pkg:npm/ms@2.1.2","UID":"980c6e163d28bdc2","BOMRef":"pkg:npm/ms@2.1.2"},"Version":"2.1.2","Licenses":["MIT"],"Digest":"sha512:b0690fc7e56332d980e8c5f6ee80381411442c50996784b85ea7863970afebcb53fa36f7be4fd1c9a2963f43d32b25ad98b48cd1bf9a7544c4bdbb353c4687db"}]}],"UncheckedComponents":{"Count":0,"Components":[]}},"scancode":{"headers":[{"tool_name":"scancode-toolkit","tool_version":"32.5.0","options":{"input":["/src"],"--ignore":["node_modules","vendor","bower_components",".venv","venv","virtualenv","site-packages","dist","build","target","out",".next",".nuxt","__pycache__",".gradle",".git",".hg",".svn",".tox",".mypy_cache",".pytest_cache",".ruff_cache",".idea",".vscode","pnpm-workspace_1.0.0"],"--json-pp":"/tmp/bomlens-scancode.fACqv3","--license":true,"--only-findings":false,"--strip-root":true},"notice":"Generated with ScanCode and provided on an \"AS IS\" BASIS, WITHOUT WARRANTIES\nOR CONDITIONS OF ANY KIND, either express or implied. No content created from\nScanCode should be considered or used as legal advice. Consult an Attorney\nfor any legal advice.\nScanCode is a free software code scanning tool from nexB Inc. and others.\nVisit https://github.com/nexB/scancode-toolkit/ for support and download.","start_timestamp":"2026-10-14T230003.017577","end_timestamp":"2026-10-14T230005.935436","output_format_version":"4.1.0","duration":2.9178738594055176,"message":null,"errors":[],"warnings":[],"extra_data":{"system_environment":{"operating_system":"linux","cpu_architecture":"64","platform":"Linux-6.8.0-100-generic-aarch64-with-glibc2.41","platform_version":"#100-Ubuntu SMP PREEMPT_DYNAMIC Tue Jan 13 16:39:21 UTC 2026","python_version":"3.12.14 (main, Sep 19 2026, 01:11:14) [GCC 14.2.0]"},"spdx_license_list_version":"3.27","files_count":5}}],"license_detections":[],"files":[{"path":"package.json","type":"file","detected_license_expression":null,"detected_license_expression_spdx":null,"license_detections":[],"license_clues":[],"percentage_of_license_text":0,"scan_errors":[]},{"path":"pnpm-lock.yaml","type":"file","detected_license_expression":null,"detected_license_expression_spdx":null,"license_detections":[],"license_clues":[],"percentage_of_license_text":0,"scan_errors":[]},{"path":"pnpm-workspace.yaml","type":"file","detected_license_expression":null,"detected_license_expression_spdx":null,"license_detections":[],"license_clues":[],"percentage_of_license_text":0,"scan_errors":[]},{"path":"packages","type":"directory","detected_license_expression":null,"detected_license_expression_spdx":null,"license_detections":[],"license_clues":[],"percentage_of_license_text":0,"scan_errors":[]},{"path":"packages/app","type":"directory","detected_license_expression":null,"detected_license_expression_spdx":null,"license_detections":[],"license_clues":[],"percentage_of_license_text":0,"scan_errors":[]},{"path":"packages/app/package.json","type":"file","detected_license_expression":null,"detected_license_expression_spdx":null,"license_detections":[],"license_clues":[],"percentage_of_license_text":0,"scan_errors":[]},{"path":"packages/util","type":"directory","detected_license_expression":null,"detected_license_expression_spdx":null,"license_detections":[],"license_clues":[],"percentage_of_license_text":0,"scan_errors":[]},{"path":"packages/util/package.json","type":"file","detected_license_expression":null,"detected_license_expression_spdx":null,"license_detections":[],"license_clues":[],"percentage_of_license_text":0,"scan_errors":[]}]}}