@cryptotaxi247 / documentation-1
Code Commits Issues Pulls Sessions CI/CD
reggi/cache-based-on-version
@reggi/path-to-regexp dependabot/npm_and_yarn/main/copy-to-clipboard-4.0.2 dependabot/npm_and_yarn/main/eslint-10.4.0 dependabot/npm_and_yarn/main/npmcli/eslint-config-7.0.0 dependabot/npm_and_yarn/main/proc-log-7.0.0 dependabot/npm_and_yarn/npm_and_yarn-826852524d dependabot/npm_and_yarn/npm_and_yarn-ab9a7f4bc2 deprecate-totp-2fa dhei/classic-tokens gat-bypass-2fa-docs jpg619/fix-accessibility-content-flow jpg619/version-bump-tar-2 kartykp/gat-bypass-2fa-docs kartykp/upgrade-path-to-regex main maitxn/version-bump-tar patch-1 reggi/cache-based-on-version reggi/dev-engines reggi/fix-transform-prettier reggi/overrides update-search-sensitivity
mdx 311 lines 9.05 KB
Raw
1 ---
2 title: npm-sbom
3 section: 1
4 description: Generate a Software Bill of Materials (SBOM)
5 github_repo: npm/cli
6 github_branch: latest
7 github_path: docs/lib/content/commands/npm-sbom.md
8 redirect_from:
9 - /cli-commands/npm-sbom
10 - /cli-commands/sbom
11 - /cli-documentation/cli-commands/npm-sbom
12 - /cli-documentation/cli-commands/sbom
13 - /cli-documentation/commands/npm-sbom
14 - /cli-documentation/commands/sbom
15 - /cli-documentation/npm-sbom
16 - /cli-documentation/sbom
17 - /cli-documentation/v11/cli-commands/npm-sbom
18 - /cli-documentation/v11/cli-commands/sbom
19 - /cli-documentation/v11/commands/npm-sbom
20 - /cli-documentation/v11/commands/sbom
21 - /cli-documentation/v11/npm-sbom
22 - /cli-documentation/v11/sbom
23 - /cli/cli-commands/npm-sbom
24 - /cli/cli-commands/sbom
25 - /cli/commands/npm-sbom
26 - /cli/commands/sbom
27 - /cli/npm-sbom
28 - /cli/sbom
29 - /cli/v11/cli-commands/npm-sbom
30 - /cli/v11/cli-commands/sbom
31 - /cli/v11/commands/sbom
32 - /cli/v11/npm-sbom
33 - /cli/v11/sbom
34 - /commands/npm-sbom
35 - /commands/sbom
36 ---
37
38 ### Synopsis
39
40 ```bash
41 npm sbom
42 ```
43
44 ### Description
45
46 The `npm sbom` command generates a Software Bill of Materials (SBOM) listing the dependencies for the current project. SBOMs can be generated in either [SPDX](https://spdx.dev/) or [CycloneDX](https://cyclonedx.org/) format.
47
48 ### Example CycloneDX SBOM
49
50 ```json
51 {
52 "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
53 "bomFormat": "CycloneDX",
54 "specVersion": "1.5",
55 "serialNumber": "urn:uuid:09f55116-97e1-49cf-b3b8-44d0207e7730",
56 "version": 1,
57 "metadata": {
58 "timestamp": "2023-09-01T00:00:00.001Z",
59 "lifecycles": [
60 {
61 "phase": "build"
62 }
63 ],
64 "tools": [
65 {
66 "vendor": "npm",
67 "name": "cli",
68 "version": "10.1.0"
69 }
70 ],
71 "component": {
72 "bom-ref": "simple@1.0.0",
73 "type": "library",
74 "name": "simple",
75 "version": "1.0.0",
76 "scope": "required",
77 "author": "John Doe",
78 "description": "simple react app",
79 "purl": "pkg:npm/simple@1.0.0",
80 "properties": [
81 {
82 "name": "cdx:npm:package:path",
83 "value": ""
84 }
85 ],
86 "externalReferences": [],
87 "licenses": [
88 {
89 "license": {
90 "id": "MIT"
91 }
92 }
93 ]
94 }
95 },
96 "components": [
97 {
98 "bom-ref": "lodash@4.17.21",
99 "type": "library",
100 "name": "lodash",
101 "version": "4.17.21",
102 "scope": "required",
103 "author": "John-David Dalton",
104 "description": "Lodash modular utilities.",
105 "purl": "pkg:npm/lodash@4.17.21",
106 "properties": [
107 {
108 "name": "cdx:npm:package:path",
109 "value": "node_modules/lodash"
110 }
111 ],
112 "externalReferences": [
113 {
114 "type": "distribution",
115 "url": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz"
116 },
117 {
118 "type": "vcs",
119 "url": "git+https://github.com/lodash/lodash.git"
120 },
121 {
122 "type": "website",
123 "url": "https://lodash.com/"
124 },
125 {
126 "type": "issue-tracker",
127 "url": "https://github.com/lodash/lodash/issues"
128 }
129 ],
130 "hashes": [
131 {
132 "alg": "SHA-512",
133 "content": "bf690311ee7b95e713ba568322e3533f2dd1cb880b189e99d4edef13592b81764daec43e2c54c61d5c558dc5cfb35ecb85b65519e74026ff17675b6f8f916f4a"
134 }
135 ],
136 "licenses": [
137 {
138 "license": {
139 "id": "MIT"
140 }
141 }
142 ]
143 }
144 ],
145 "dependencies": [
146 {
147 "ref": "simple@1.0.0",
148 "dependsOn": ["lodash@4.17.21"]
149 },
150 {
151 "ref": "lodash@4.17.21",
152 "dependsOn": []
153 }
154 ]
155 }
156 ```
157
158 ### Example SPDX SBOM
159
160 ```json
161 {
162 "spdxVersion": "SPDX-2.3",
163 "dataLicense": "CC0-1.0",
164 "SPDXID": "SPDXRef-DOCUMENT",
165 "name": "simple@1.0.0",
166 "documentNamespace": "http://spdx.org/spdxdocs/simple-1.0.0-bf81090e-8bbc-459d-bec9-abeb794e096a",
167 "creationInfo": {
168 "created": "2023-09-01T00:00:00.001Z",
169 "creators": ["Tool: npm/cli-10.1.0"]
170 },
171 "documentDescribes": ["SPDXRef-Package-simple-1.0.0"],
172 "packages": [
173 {
174 "name": "simple",
175 "SPDXID": "SPDXRef-Package-simple-1.0.0",
176 "versionInfo": "1.0.0",
177 "packageFileName": "",
178 "description": "simple react app",
179 "primaryPackagePurpose": "LIBRARY",
180 "downloadLocation": "NOASSERTION",
181 "filesAnalyzed": false,
182 "homepage": "NOASSERTION",
183 "licenseDeclared": "MIT",
184 "externalRefs": [
185 {
186 "referenceCategory": "PACKAGE-MANAGER",
187 "referenceType": "purl",
188 "referenceLocator": "pkg:npm/simple@1.0.0"
189 }
190 ]
191 },
192 {
193 "name": "lodash",
194 "SPDXID": "SPDXRef-Package-lodash-4.17.21",
195 "versionInfo": "4.17.21",
196 "packageFileName": "node_modules/lodash",
197 "description": "Lodash modular utilities.",
198 "downloadLocation": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
199 "filesAnalyzed": false,
200 "homepage": "https://lodash.com/",
201 "licenseDeclared": "MIT",
202 "externalRefs": [
203 {
204 "referenceCategory": "PACKAGE-MANAGER",
205 "referenceType": "purl",
206 "referenceLocator": "pkg:npm/lodash@4.17.21"
207 }
208 ],
209 "checksums": [
210 {
211 "algorithm": "SHA512",
212 "checksumValue": "bf690311ee7b95e713ba568322e3533f2dd1cb880b189e99d4edef13592b81764daec43e2c54c61d5c558dc5cfb35ecb85b65519e74026ff17675b6f8f916f4a"
213 }
214 ]
215 }
216 ],
217 "relationships": [
218 {
219 "spdxElementId": "SPDXRef-DOCUMENT",
220 "relatedSpdxElement": "SPDXRef-Package-simple-1.0.0",
221 "relationshipType": "DESCRIBES"
222 },
223 {
224 "spdxElementId": "SPDXRef-Package-simple-1.0.0",
225 "relatedSpdxElement": "SPDXRef-Package-lodash-4.17.21",
226 "relationshipType": "DEPENDS_ON"
227 }
228 ]
229 }
230 ```
231
232 ### Package lock only mode
233
234 If package-lock-only is enabled, only the information in the package lock (or shrinkwrap) is loaded. This means that information from the package.json files of your dependencies will not be included in the result set (e.g. description, homepage, engines).
235
236 ### Configuration
237
238 #### `omit`
239
240 - Default: 'dev' if the `NODE_ENV` environment variable is set to 'production', otherwise empty.
241 - Type: "dev", "optional", or "peer" (can be set multiple times)
242
243 Dependency types to omit from the installation tree on disk.
244
245 Note that these dependencies _are_ still resolved and added to the `package-lock.json` or `npm-shrinkwrap.json` file. They are just not physically installed on disk.
246
247 If a package type appears in both the `--include` and `--omit` lists, then it will be included.
248
249 If the resulting omit list includes `'dev'`, then the `NODE_ENV` environment variable will be set to `'production'` for all lifecycle scripts.
250
251 #### `package-lock-only`
252
253 - Default: false
254 - Type: Boolean
255
256 If set to true, the current operation will only use the `package-lock.json`, ignoring `node_modules`.
257
258 For `update` this means only the `package-lock.json` will be updated, instead of checking `node_modules` and downloading dependencies.
259
260 For `list` this means the output will be based on the tree described by the `package-lock.json`, rather than the contents of `node_modules`.
261
262 #### `sbom-format`
263
264 - Default: null
265 - Type: "cyclonedx" or "spdx"
266
267 SBOM format to use when generating SBOMs.
268
269 #### `sbom-type`
270
271 - Default: "library"
272 - Type: "library", "application", or "framework"
273
274 The type of package described by the generated SBOM. For SPDX, this is the value for the `primaryPackagePurpose` field. For CycloneDX, this is the value for the `type` field.
275
276 #### `workspace`
277
278 - Default:
279 - Type: String (can be set multiple times)
280
281 Enable running a command in the context of the configured workspaces of the current project while filtering by running only the workspaces defined by this configuration option.
282
283 Valid values for the `workspace` config are either:
284
285 - Workspace names
286 - Path to a workspace directory
287 - Path to a parent workspace directory (will result in selecting all workspaces within that folder)
288
289 When set for the `npm init` command, this may be set to the folder of a workspace which does not yet exist, to create the folder and set it up as a brand new workspace within the project.
290
291 This value is not exported to the environment for child processes.
292
293 #### `workspaces`
294
295 - Default: null
296 - Type: null or Boolean
297
298 Set to true to run the command in the context of **all** configured workspaces.
299
300 Explicitly setting this to false will cause commands like `install` to ignore workspaces altogether. When not set explicitly:
301
302 - Commands that operate on the `node_modules` tree (install, update, etc.) will link workspaces into the `node_modules` folder. - Commands that do other things (test, exec, publish, etc.) will operate on the root project, _unless_ one or more workspaces are specified in the `workspace` config.
303
304 This value is not exported to the environment for child processes.
305
306 ## See Also
307
308 - [package spec](/cli/v11/using-npm/package-spec)
309 - [dependency selectors](/cli/v11/using-npm/dependency-selectors)
310 - [package.json](/cli/v11/configuring-npm/package-json)
311 - [workspaces](/cli/v11/using-npm/workspaces)