@cryptotaxi247 / documentation
Code Commits Issues Pulls Sessions CI/CD
maitxn/version-bump-tar
@reggi/path-to-regexp dependabot/npm_and_yarn/main/copy-to-clipboard-4.0.2 dependabot/npm_and_yarn/main/eslint-10.4.0 dependabot/npm_and_yarn/main/npmcli/eslint-config-7.0.0 dependabot/npm_and_yarn/main/proc-log-7.0.0 dependabot/npm_and_yarn/npm_and_yarn-826852524d dependabot/npm_and_yarn/npm_and_yarn-ab9a7f4bc2 deprecate-totp-2fa dhei/classic-tokens gat-bypass-2fa-docs jpg619/fix-accessibility-content-flow jpg619/version-bump-tar-2 kartykp/gat-bypass-2fa-docs kartykp/upgrade-path-to-regex main maitxn/version-bump-tar patch-1 reggi/cache-based-on-version reggi/dev-engines reggi/fix-transform-prettier reggi/overrides update-search-sensitivity
mdx 295 lines 8.59 KB
Raw
1 ---
2 title: npm-sbom
3 section: 1
4 description: Generate a Software Bill of Materials (SBOM)
5 github_repo: npm/cli
6 github_branch: release/v9
7 github_path: docs/lib/content/commands/npm-sbom.md
8 redirect_from:
9 - /cli-documentation/v9/cli-commands/npm-sbom
10 - /cli-documentation/v9/cli-commands/sbom
11 - /cli-documentation/v9/commands/npm-sbom
12 - /cli-documentation/v9/commands/sbom
13 - /cli-documentation/v9/npm-sbom
14 - /cli-documentation/v9/sbom
15 - /cli/v9/cli-commands/npm-sbom
16 - /cli/v9/cli-commands/sbom
17 - /cli/v9/commands/sbom
18 - /cli/v9/npm-sbom
19 - /cli/v9/sbom
20 ---
21
22 ### Synopsis
23
24 ```bash
25 npm sbom
26 ```
27
28 ### Description
29
30 The `npm sbom` command generates a Software Bill of Materials (SBOM) listing the dependencies for the current project. SBOMs can be generated in either [SPDX](https://spdx.dev/) or [CycloneDX](https://cyclonedx.org/) format.
31
32 ### Example CycloneDX SBOM
33
34 ```json
35 {
36 "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
37 "bomFormat": "CycloneDX",
38 "specVersion": "1.5",
39 "serialNumber": "urn:uuid:09f55116-97e1-49cf-b3b8-44d0207e7730",
40 "version": 1,
41 "metadata": {
42 "timestamp": "2023-09-01T00:00:00.001Z",
43 "lifecycles": [
44 {
45 "phase": "build"
46 }
47 ],
48 "tools": [
49 {
50 "vendor": "npm",
51 "name": "cli",
52 "version": "10.1.0"
53 }
54 ],
55 "component": {
56 "bom-ref": "simple@1.0.0",
57 "type": "library",
58 "name": "simple",
59 "version": "1.0.0",
60 "scope": "required",
61 "author": "John Doe",
62 "description": "simple react app",
63 "purl": "pkg:npm/simple@1.0.0",
64 "properties": [
65 {
66 "name": "cdx:npm:package:path",
67 "value": ""
68 }
69 ],
70 "externalReferences": [],
71 "licenses": [
72 {
73 "license": {
74 "id": "MIT"
75 }
76 }
77 ]
78 }
79 },
80 "components": [
81 {
82 "bom-ref": "lodash@4.17.21",
83 "type": "library",
84 "name": "lodash",
85 "version": "4.17.21",
86 "scope": "required",
87 "author": "John-David Dalton",
88 "description": "Lodash modular utilities.",
89 "purl": "pkg:npm/lodash@4.17.21",
90 "properties": [
91 {
92 "name": "cdx:npm:package:path",
93 "value": "node_modules/lodash"
94 }
95 ],
96 "externalReferences": [
97 {
98 "type": "distribution",
99 "url": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz"
100 },
101 {
102 "type": "vcs",
103 "url": "git+https://github.com/lodash/lodash.git"
104 },
105 {
106 "type": "website",
107 "url": "https://lodash.com/"
108 },
109 {
110 "type": "issue-tracker",
111 "url": "https://github.com/lodash/lodash/issues"
112 }
113 ],
114 "hashes": [
115 {
116 "alg": "SHA-512",
117 "content": "bf690311ee7b95e713ba568322e3533f2dd1cb880b189e99d4edef13592b81764daec43e2c54c61d5c558dc5cfb35ecb85b65519e74026ff17675b6f8f916f4a"
118 }
119 ],
120 "licenses": [
121 {
122 "license": {
123 "id": "MIT"
124 }
125 }
126 ]
127 }
128 ],
129 "dependencies": [
130 {
131 "ref": "simple@1.0.0",
132 "dependsOn": ["lodash@4.17.21"]
133 },
134 {
135 "ref": "lodash@4.17.21",
136 "dependsOn": []
137 }
138 ]
139 }
140 ```
141
142 ### Example SPDX SBOM
143
144 ```json
145 {
146 "spdxVersion": "SPDX-2.3",
147 "dataLicense": "CC0-1.0",
148 "SPDXID": "SPDXRef-DOCUMENT",
149 "name": "simple@1.0.0",
150 "documentNamespace": "http://spdx.org/spdxdocs/simple-1.0.0-bf81090e-8bbc-459d-bec9-abeb794e096a",
151 "creationInfo": {
152 "created": "2023-09-01T00:00:00.001Z",
153 "creators": ["Tool: npm/cli-10.1.0"]
154 },
155 "documentDescribes": ["SPDXRef-Package-simple-1.0.0"],
156 "packages": [
157 {
158 "name": "simple",
159 "SPDXID": "SPDXRef-Package-simple-1.0.0",
160 "versionInfo": "1.0.0",
161 "packageFileName": "",
162 "description": "simple react app",
163 "primaryPackagePurpose": "LIBRARY",
164 "downloadLocation": "NOASSERTION",
165 "filesAnalyzed": false,
166 "homepage": "NOASSERTION",
167 "licenseDeclared": "MIT",
168 "externalRefs": [
169 {
170 "referenceCategory": "PACKAGE-MANAGER",
171 "referenceType": "purl",
172 "referenceLocator": "pkg:npm/simple@1.0.0"
173 }
174 ]
175 },
176 {
177 "name": "lodash",
178 "SPDXID": "SPDXRef-Package-lodash-4.17.21",
179 "versionInfo": "4.17.21",
180 "packageFileName": "node_modules/lodash",
181 "description": "Lodash modular utilities.",
182 "downloadLocation": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
183 "filesAnalyzed": false,
184 "homepage": "https://lodash.com/",
185 "licenseDeclared": "MIT",
186 "externalRefs": [
187 {
188 "referenceCategory": "PACKAGE-MANAGER",
189 "referenceType": "purl",
190 "referenceLocator": "pkg:npm/lodash@4.17.21"
191 }
192 ],
193 "checksums": [
194 {
195 "algorithm": "SHA512",
196 "checksumValue": "bf690311ee7b95e713ba568322e3533f2dd1cb880b189e99d4edef13592b81764daec43e2c54c61d5c558dc5cfb35ecb85b65519e74026ff17675b6f8f916f4a"
197 }
198 ]
199 }
200 ],
201 "relationships": [
202 {
203 "spdxElementId": "SPDXRef-DOCUMENT",
204 "relatedSpdxElement": "SPDXRef-Package-simple-1.0.0",
205 "relationshipType": "DESCRIBES"
206 },
207 {
208 "spdxElementId": "SPDXRef-Package-simple-1.0.0",
209 "relatedSpdxElement": "SPDXRef-Package-lodash-4.17.21",
210 "relationshipType": "DEPENDS_ON"
211 }
212 ]
213 }
214 ```
215
216 ### Package lock only mode
217
218 If package-lock-only is enabled, only the information in the package lock (or shrinkwrap) is loaded. This means that information from the package.json files of your dependencies will not be included in the result set (e.g. description, homepage, engines).
219
220 ### Configuration
221
222 #### `omit`
223
224 - Default: 'dev' if the `NODE_ENV` environment variable is set to 'production', otherwise empty.
225 - Type: "dev", "optional", or "peer" (can be set multiple times)
226
227 Dependency types to omit from the installation tree on disk.
228
229 Note that these dependencies _are_ still resolved and added to the `package-lock.json` or `npm-shrinkwrap.json` file. They are just not physically installed on disk.
230
231 If a package type appears in both the `--include` and `--omit` lists, then it will be included.
232
233 If the resulting omit list includes `'dev'`, then the `NODE_ENV` environment variable will be set to `'production'` for all lifecycle scripts.
234
235 #### `package-lock-only`
236
237 - Default: false
238 - Type: Boolean
239
240 If set to true, the current operation will only use the `package-lock.json`, ignoring `node_modules`.
241
242 For `update` this means only the `package-lock.json` will be updated, instead of checking `node_modules` and downloading dependencies.
243
244 For `list` this means the output will be based on the tree described by the `package-lock.json`, rather than the contents of `node_modules`.
245
246 #### `sbom-format`
247
248 - Default: null
249 - Type: "cyclonedx" or "spdx"
250
251 SBOM format to use when generating SBOMs.
252
253 #### `sbom-type`
254
255 - Default: "library"
256 - Type: "library", "application", or "framework"
257
258 The type of package described by the generated SBOM. For SPDX, this is the value for the `primaryPackagePurpose` field. For CycloneDX, this is the value for the `type` field.
259
260 #### `workspace`
261
262 - Default:
263 - Type: String (can be set multiple times)
264
265 Enable running a command in the context of the configured workspaces of the current project while filtering by running only the workspaces defined by this configuration option.
266
267 Valid values for the `workspace` config are either:
268
269 - Workspace names
270 - Path to a workspace directory
271 - Path to a parent workspace directory (will result in selecting all workspaces within that folder)
272
273 When set for the `npm init` command, this may be set to the folder of a workspace which does not yet exist, to create the folder and set it up as a brand new workspace within the project.
274
275 This value is not exported to the environment for child processes.
276
277 #### `workspaces`
278
279 - Default: null
280 - Type: null or Boolean
281
282 Set to true to run the command in the context of **all** configured workspaces.
283
284 Explicitly setting this to false will cause commands like `install` to ignore workspaces altogether. When not set explicitly:
285
286 - Commands that operate on the `node_modules` tree (install, update, etc.) will link workspaces into the `node_modules` folder. - Commands that do other things (test, exec, publish, etc.) will operate on the root project, _unless_ one or more workspaces are specified in the `workspace` config.
287
288 This value is not exported to the environment for child processes.
289
290 ## See Also
291
292 - [package spec](/cli/v9/using-npm/package-spec)
293 - [dependency selectors](/cli/v9/using-npm/dependency-selectors)
294 - [package.json](/cli/v9/configuring-npm/package-json)
295 - [workspaces](/cli/v9/using-npm/workspaces)