# @cyclonedx/bom

> Meta-package for known CycloneDX Software Bill of Materials (SBOM) generators

Latest version **4.1.6** (published 2026-07-10) · Apache-2.0 license · 0 weekly downloads

## Install

```sh
npm install @cyclonedx/bom
pnpm add @cyclonedx/bom
yarn add @cyclonedx/bom
bun add @cyclonedx/bom
```

## Health

**Score 60/100 (C)** — status: active.

Positive: no vulnerabilities; has provenance; recently updated; high maintenance score.

Warnings: low downloads; no types; no esm support.

## Facts

| | |
|---|---|
| Version | 4.1.6 |
| Published | 2026-07-10 |
| First published | 2018-05-22 |
| Weekly downloads | 0 |
| License | Apache-2.0 |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 0 |
| Unpacked size | 17.4 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 145 |
| Maintainers | sspringett, eoftedal, coderpatros, cyclonedx-automation, jkowalleck |

## Links

- npm: https://www.npmjs.com/package/@cyclonedx/bom
- Repository: https://github.com/CycloneDX/cyclonedx-node-module
- Homepage: https://github.com/CycloneDX/cyclonedx-node-module#readme
- Issues: https://github.com/CycloneDX/cyclonedx-node-module/issues
- npm.io page: https://npm.io/package/@cyclonedx/bom

## Recent versions

- 4.1.6 (latest) — 2026-07-10
- 4.1.2-alpha.0 (unstable-prerelease) — 2025-05-26
- 4.1.5 — 2026-03-19
- 4.1.4 — 2026-03-16
- 4.1.3 — 2025-11-13
- 4.1.2 — 2025-09-15
- 4.1.1-alpha.0 — 2025-05-26
- 4.1.0 — 2024-06-26
- 4.0.5 — 2024-05-06
- 4.0.4 — 2024-03-28
- 4.0.3 — 2022-12-16
- 4.0.2 — 2022-10-21
- 4.0.1 — 2022-10-21
- 4.0.0 — 2022-10-21
- 4.0.0-rc.1 — 2022-10-21
- … 52 more at https://npm.io/package/@cyclonedx/bom/versions

## README

# CycloneDX BOM for Node.js

[![shield_npm-version]][link_npm]
[![shield_gh-workflow-test]][link_gh-workflow-test]
[![shield_license]][license_file]  
[![shield_website]][link_website]
[![shield_slack]][link_slack]
[![shield_groups]][link_discussion]
[![shield_twitter-follow]][link_twitter]

----

This is a so-called **meta-package**, it does not ship any own functionality, but it is a collection of optional dependencies.
This package's dependencies are tools* with one purpose in common:  
generate _[CycloneDX][link_website]_ Software-Bill-of-Materials (SBOM) from _node_-based projects.

| Ecosystem | Actual Tool |
|:---------:|:------------|
| _npm_ | [@cyclonedx/cyclonedx-npm](https://www.npmjs.com/package/%40cyclonedx/cyclonedx-npm) |
| _pnpm_ | Native subcommand: [`pnpm sbom`](https://pnpm.io/cli/sbom) |
| _yarn_ | [@cyclonedx/yarn-plugin-cyclonedx](https://www.npmjs.com/package/%40cyclonedx/yarn-plugin-cyclonedx) |

*) You should not depend on this very meta-package, instead depend on the actual tool that fits your specific (eco)system.

## Out of Scope

There are systems, that are not node-targeting, but use node as a runtime/compiler environment, or use node package registry as a distribution system.
These systems are out of scope. Therefore, the following tools are not part of this very meta-package.

| System | Actual Tool(s) |
|:------:|:---------------|
| _Angular_ | Utilize [@cyclonedx/cyclonedx-esbuild](https://www.npmjs.com/package/@cyclonedx/cyclonedx-esbuild?activeTab=readme#use-with-angular) or [@cyclonedx/webpack-plugin](https://www.npmjs.com/package/%40cyclonedx/webpack-plugin?activeTab=readme#use-with-angular) |
| _Bun_ | Utilize [@cyclonedx/cyclonedx-esbuild](https://www.npmjs.com/package/@cyclonedx/cyclonedx-esbuild?activeTab=readme#plugin-example-bun) |
| _Bower_ | None. (_Bower_ is [deprecated](https://bower.io/blog/2017/how-to-migrate-away-from-bower/)!) |
| _Esbuild_ | [@cyclonedx/cyclonedx-esbuild](https://www.npmjs.com/package/%40cyclonedx/cyclonedx-esbuild) |
| _Parcel_ | To be announced, suggestions welcome |
| _React_ | Utilize [@cyclonedx/webpack-plugin](https://www.npmjs.com/package/%40cyclonedx/webpack-plugin?activeTab=readme#use-with-react) |
| _Rollup_ | [rollup-plugin-sbom](https://www.npmjs.com/package/rollup-plugin-sbom) |
| _Rspack_/_Rsbuild_ | To be announced, suggestions welcome |
| _Svelte_ | To be announced, suggestions welcome |
| _Vite_ | Utilize [rollup-plugin-sbom](https://www.npmjs.com/package/rollup-plugin-sbom?activeTab=readme#usage-with-vite) |
| _Vue_ | Utilize [rollup-plugin-sbom](https://www.npmjs.com/package/rollup-plugin-sbom?activeTab=readme#usage-with-vite) or [@cyclonedx/webpack-plugin](https://www.npmjs.com/package/%40cyclonedx/webpack-plugin?activeTab=readme#use-with-vue) | 
| _Webpack_ | [@cyclonedx/webpack-plugin](https://www.npmjs.com/package/%40cyclonedx/webpack-plugin) |

## Library

If you are looking for a JavaScript/TypeScript library for working with CycloneDX, its data models or serialization,
then you might want to try [@cyclonedx/cyclonedx-library](https://www.npmjs.com/package/%40cyclonedx/cyclonedx-library).

## Contributing

You want to have a certain node-based tool added?  
Feel free to open issues, bugreports or pull requests.  
See the [CONTRIBUTING][contributing_file] file for details.

## Copyright & License

CycloneDX Node Module is Copyright (c) OWASP Foundation. All Rights Reserved.

Permission to modify and redistribute is granted under the terms of the Apache 2.0 license.  
See the [LICENSE][license_file] file for the full license.

----

## Previous versions

This project used to be a tool-set and a library to work and generate [CycloneDX][link_website] Software Bill-of-Materials (SBOM) from _npm_ and _yarn_ based projects.  
Since version 4.0, this was all split to individual projects, and this project changed to a bare meta-package.

Previous versions of this very package are still available
via [npmjs versions](https://www.npmjs.com/package/@cyclonedx/bom?activeTab=versions)
and [github releases](https://github.com/CycloneDX/cyclonedx-node-module/releases)

[license_file]: https://github.com/CycloneDX/cyclonedx-node-module/blob/master/LICENSE
[contributing_file]: https://github.com/CycloneDX/cyclonedx-node-module/blob/master/CONTRIBUTING.md

[shield_gh-workflow-test]: https://img.shields.io/github/actions/workflow/status/CycloneDX/cyclonedx-node-module/nodejs.yml?branch=master&logo=GitHub&logoColor=white "build"
[shield_npm-version]: https://img.shields.io/npm/v/%40cyclonedx%2fbom/latest?label=npm&logo=npm&logoColor=white "npm"
[shield_docker-version]: https://img.shields.io/docker/v/cyclonedx/cyclonedx-node?logo=docker&logoColor=white&label=docker "docker"
[shield_license]: https://img.shields.io/badge/license-Apache%202.0-brightgreen.svg?logo=open%20source%20initiative&logoColor=white "license"
[shield_website]: https://img.shields.io/badge/https://-cyclonedx.org-blue.svg "homepage"
[shield_slack]: https://img.shields.io/badge/slack-join-blue?logo=Slack&logoColor=white "slack join"
[shield_groups]: https://img.shields.io/badge/discussion-groups.io-blue.svg "groups discussion"
[shield_twitter-follow]: https://img.shields.io/badge/Twitter-follow-blue?logo=Twitter&logoColor=white "twitter follow"
[link_gh-workflow-test]: https://github.com/CycloneDX/cyclonedx-node-module/actions/workflows/nodejs.yml?query=branch%3Amaster
[link_npm]: https://www.npmjs.com/package/%40cyclonedx/bom
[link_docker]: https://hub.docker.com/r/cyclonedx/cyclonedx-node
[link_website]: https://cyclonedx.org/
[link_slack]: https://cyclonedx.org/slack/invite
[link_discussion]: https://groups.io/g/CycloneDX
[link_twitter]: https://twitter.com/CycloneDX_Spec

---
_Source: https://npm.io/package/@cyclonedx/bom · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._