CycloneDX Node.js Module

The CycloneDX module for Node.js creates a valid CycloneDX Software Bill-of-Materials (SBOM) containing an aggregate of all project dependencies. CycloneDX is a lightweight SBOM specification that is easily created, human and machine readable, and simple to parse.

Requirements

Node.js v8.0.0 or higher

Usage

Installing

npm install -g @cyclonedx/bom

Getting Help

$ cyclonedx-bom -h
Usage: cyclonedx-bom [OPTIONS] [path]

Creates CycloneDX Software Bill-of-Materials (SBOM) from Node.js projects

Options:
  -v, --version              output the version number
  -a, --append <bom.xml>     Merge BOM(s) into the current BOM (default: [])
  -d, --include-dev          Include devDependencies (default: false)
  -l, --include-license-text Include full license text (default: false)
  -o, --output <output>      Write BOM to file (default: "bom.xml")
  -s, --schema <version>     Target schema version (default: "1.2")
  -t, --type <type>          Project type (default: "library")
  -ns, --no-serial-number    Do not include BOM serial number
  -h, --help                 display help for command

Example (default: XML)

cyclonedx-bom

Example (XML)

cyclonedx-bom -o bom.xml

Example (JSON)

cyclonedx-bom -o bom.json

Example (Target Specification Version)

cyclonedx-bom -o bom.xml -s 1.1

CycloneDX Schema Support

The following table provides information on the version of this node module, the CycloneDX schema version supported, as well as the output format options. Use the latest possible version of this node module that is the compatible with the CycloneDX version supported by the target system.

License

Permission to modify and redistribute is granted under the terms of the Apache 2.0 license. See the LICENSE file for the full license.