{
  "bomFormat": "CycloneDX",
  "specVersion": "1.7",
  "serialNumber": "urn:uuid:0c3fc689-369c-4527-84c5-95ca7cfe4135",
  "version": 1,
  "metadata": {
    "timestamp": "2026-07-30T03:40:51Z",
    "tools": {
      "components": [
        {
          "group": "@cyclonedx",
          "name": "cdxgen",
          "version": "12.3.3",
          "purl": "pkg:npm/%40cyclonedx/cdxgen@12.3.3",
          "type": "application",
          "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.3.3",
          "publisher": "OWASP Foundation",
          "authors": [
            {
              "name": "OWASP Foundation"
            }
          ]
        }
      ]
    },
    "authors": [
      {
        "name": "OWASP Foundation"
      }
    ],
    "lifecycles": [
      {
        "phase": "pre-build"
      }
    ],
    "component": {
      "name": "commander",
      "group": "",
      "version": "2.13.0",
      "description": "the complete solution for node.js command-line programs",
      "purl": "pkg:npm/commander@2.13.0",
      "bom-ref": "pkg:npm/commander@2.13.0",
      "author": "TJ Holowaychuk <tj@vision-media.ca>",
      "properties": [
        {
          "name": "cdx:npm:scripts",
          "value": "test, test-typings"
        }
      ],
      "type": "application",
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "externalReferences": [
        {
          "type": "vcs",
          "url": "https://github.com/tj/commander.js.git"
        }
      ]
    },
    "properties": [
      {
        "name": "cdx:bom:componentTypes",
        "value": "npm"
      },
      {
        "name": "cdx:bom:componentNamespaces",
        "value": "@types"
      },
      {
        "name": "cdx:bom:componentSrcFiles",
        "value": "package-lock.json"
      }
    ]
  },
  "components": [
    {
      "group": "@types",
      "name": "node",
      "version": "7.0.48",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "2cb95769f337043e76307d39ead1f14d73bc2450a7a4925091dcc8537fa6f1ec3e097258ff9cc85e00cd6f84cafd016f948f107b12d2e6d2feb04d1085e82bd7"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/%40types/node@7.0.48",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/@types/node/-/node-7.0.48.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@types/node@7.0.48",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/@types/node/-/node-7.0.48.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "should",
      "version": "11.2.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "90f55145552d01cfc200666e4e818a1c9670eda2"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/should@11.2.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/should/-/should-11.2.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/should@11.2.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/should/-/should-11.2.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "should-equal",
      "version": "1.0.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0b6e9516f2601a9fb0bb2dcc369afa1c7e200af7"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/should-equal@1.0.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/should-equal/-/should-equal-1.0.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/should-equal@1.0.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/should-equal/-/should-equal-1.0.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "should-type",
      "version": "1.4.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0756d8ce846dfd09843a6947719dfa0d4cff5cf3"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/should-type@1.4.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/should-type/-/should-type-1.4.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/should-type@1.4.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/should-type/-/should-type-1.4.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "should-format",
      "version": "3.0.3",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9bfc8f74fa39205c53d38c34d717303e277124f1"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/should-format@3.0.3",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/should-format/-/should-format-3.0.3.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/should-format@3.0.3",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/should-format/-/should-format-3.0.3.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "should-type-adaptors",
      "version": "1.0.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "efe5553cdf68cff66e5c5f51b712dc351c77beaa"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/should-type-adaptors@1.0.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/should-type-adaptors/-/should-type-adaptors-1.0.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/should-type-adaptors@1.0.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/should-type-adaptors/-/should-type-adaptors-1.0.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "should-util",
      "version": "1.0.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c98cda374aa6b190df8ba87c9889c2b4db620063"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/should-util@1.0.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/should-util/-/should-util-1.0.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/should-util@1.0.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/should-util/-/should-util-1.0.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "sinon",
      "version": "2.4.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "bc54eb3bd5add0409f7c36083d23ff1396c1ba0b7452370140e7d050c87aeb1ce4c8f127865fef3362d1662d9a8ee4dd907d3bb00e83ceb33a2af76f1881fcc7"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "BSD-3-Clause",
            "url": "https://opensource.org/licenses/BSD-3-Clause"
          }
        }
      ],
      "purl": "pkg:npm/sinon@2.4.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/sinon/-/sinon-2.4.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/sinon@2.4.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/sinon/-/sinon-2.4.1.tgz"
        },
        {
          "name": "cdx:npm:deprecated",
          "value": "16.1.1"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "diff",
      "version": "3.4.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "42956e31312824c17b70ace2e9bbd6851ba55357d9a999efc954203613dac71b93630ca39ff8f5bfd7da96c790fee5d6c0f9cee7a4417f0b60e21fc44179ae70"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "BSD-3-Clause",
            "url": "https://opensource.org/licenses/BSD-3-Clause"
          }
        }
      ],
      "purl": "pkg:npm/diff@3.4.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/diff/-/diff-3.4.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/diff@3.4.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/diff/-/diff-3.4.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "formatio",
      "version": "1.2.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f3b2167d9068c4698a8d51f4f760a39a54d818eb"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "BSD-3-Clause",
            "url": "https://opensource.org/licenses/BSD-3-Clause"
          }
        }
      ],
      "purl": "pkg:npm/formatio@1.2.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/formatio/-/formatio-1.2.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/formatio@1.2.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/formatio/-/formatio-1.2.0.tgz"
        },
        {
          "name": "cdx:npm:deprecated",
          "value": "This package is unmaintained. Use @sinonjs/formatio instead"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "samsam",
      "version": "1.3.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "d47c08603ffc5253ad152dd03b7c3b7b2f927520c51381d134b66865161541e7eb398de5d7b7a9b30226781d628e0245409a1d21a1dcc24a77aff9b20631556e"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "BSD-3-Clause",
            "url": "https://opensource.org/licenses/BSD-3-Clause"
          }
        }
      ],
      "purl": "pkg:npm/samsam@1.3.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/samsam/-/samsam-1.3.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/samsam@1.3.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/samsam/-/samsam-1.3.0.tgz"
        },
        {
          "name": "cdx:npm:deprecated",
          "value": "This package has been deprecated in favour of @sinonjs/samsam"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "lolex",
      "version": "1.6.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3a9a0283452a47d7439e72731b9e07d7386e49f6"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "BSD-3-Clause",
            "url": "https://opensource.org/licenses/BSD-3-Clause"
          }
        }
      ],
      "purl": "pkg:npm/lolex@1.6.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/lolex/-/lolex-1.6.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/lolex@1.6.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/lolex/-/lolex-1.6.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "native-promise-only",
      "version": "0.8.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "20a318c30cb45f71fe7adfbf7b21c99c1472ef11"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/native-promise-only@0.8.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/native-promise-only/-/native-promise-only-0.8.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/native-promise-only@0.8.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/native-promise-only/-/native-promise-only-0.8.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      },
      "tags": [
        "native"
      ]
    },
    {
      "group": "",
      "name": "path-to-regexp",
      "version": "1.7.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "59fde0f435badacba103a84e9d3bc64e96b9937d"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/path-to-regexp@1.7.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-1.7.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/path-to-regexp@1.7.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-1.7.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "isarray",
      "version": "0.0.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8a18acfca9a8f4177e09abfc6038939b05d1eedf"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/isarray@0.0.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/isarray/-/isarray-0.0.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/isarray@0.0.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/isarray/-/isarray-0.0.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "text-encoding",
      "version": "0.6.4",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e399a982257a276dae428bb92845cb71bdc26d19"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "Unlicense",
            "url": "https://opensource.org/licenses/Unlicense"
          }
        }
      ],
      "purl": "pkg:npm/text-encoding@0.6.4",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/text-encoding/-/text-encoding-0.6.4.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/text-encoding@0.6.4",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/text-encoding/-/text-encoding-0.6.4.tgz"
        },
        {
          "name": "cdx:npm:deprecated",
          "value": "no longer maintained"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "type-detect",
      "version": "4.0.5",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "37d22f910b255066060b6e119099356daf7d7e82ba4e4c02d851c01019501413f44714194bc66926e019730898ff0f592471506f568e5c123ad0e771853af011"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/type-detect@4.0.5",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/type-detect/-/type-detect-4.0.5.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/type-detect@4.0.5",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/type-detect/-/type-detect-4.0.5.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "typescript",
      "version": "2.6.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3c5b6fd7f6de0914269027f03c0946758f7673a4"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://opensource.org/licenses/Apache-2.0"
          }
        }
      ],
      "purl": "pkg:npm/typescript@2.6.2",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/typescript/-/typescript-2.6.2.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/typescript@2.6.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/typescript/-/typescript-2.6.2.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/@types/node@7.0.48",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/should-type@1.4.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/should-equal@1.0.1",
      "dependsOn": [
        "pkg:npm/should-type@1.4.0"
      ]
    },
    {
      "ref": "pkg:npm/should-util@1.0.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/should-type-adaptors@1.0.1",
      "dependsOn": [
        "pkg:npm/should-type@1.4.0",
        "pkg:npm/should-util@1.0.0"
      ]
    },
    {
      "ref": "pkg:npm/should-format@3.0.3",
      "dependsOn": [
        "pkg:npm/should-type-adaptors@1.0.1",
        "pkg:npm/should-type@1.4.0"
      ]
    },
    {
      "ref": "pkg:npm/should@11.2.1",
      "dependsOn": [
        "pkg:npm/should-equal@1.0.1",
        "pkg:npm/should-format@3.0.3",
        "pkg:npm/should-type-adaptors@1.0.1",
        "pkg:npm/should-type@1.4.0",
        "pkg:npm/should-util@1.0.0"
      ]
    },
    {
      "ref": "pkg:npm/diff@3.4.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/samsam@1.3.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/formatio@1.2.0",
      "dependsOn": [
        "pkg:npm/samsam@1.3.0"
      ]
    },
    {
      "ref": "pkg:npm/lolex@1.6.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/native-promise-only@0.8.1",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/isarray@0.0.1",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/path-to-regexp@1.7.0",
      "dependsOn": [
        "pkg:npm/isarray@0.0.1"
      ]
    },
    {
      "ref": "pkg:npm/text-encoding@0.6.4",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/type-detect@4.0.5",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/sinon@2.4.1",
      "dependsOn": [
        "pkg:npm/diff@3.4.0",
        "pkg:npm/formatio@1.2.0",
        "pkg:npm/lolex@1.6.0",
        "pkg:npm/native-promise-only@0.8.1",
        "pkg:npm/path-to-regexp@1.7.0",
        "pkg:npm/samsam@1.3.0",
        "pkg:npm/text-encoding@0.6.4",
        "pkg:npm/type-detect@4.0.5"
      ]
    },
    {
      "ref": "pkg:npm/typescript@2.6.2",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/commander@2.13.0",
      "dependsOn": [
        "pkg:npm/@types/node@7.0.48",
        "pkg:npm/should@11.2.1",
        "pkg:npm/sinon@2.4.1",
        "pkg:npm/typescript@2.6.2"
      ]
    }
  ],
  "annotations": [
    {
      "bom-ref": "metadata-annotations",
      "subjects": [
        "pkg:npm/commander@2.13.0"
      ],
      "annotator": {
        "component": {
          "group": "@cyclonedx",
          "name": "cdxgen",
          "version": "12.3.3",
          "purl": "pkg:npm/%40cyclonedx/cdxgen@12.3.3",
          "type": "application",
          "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.3.3",
          "publisher": "OWASP Foundation",
          "authors": [
            {
              "name": "OWASP Foundation"
            }
          ]
        }
      },
      "timestamp": "2026-07-30T03:40:51Z",
      "text": "This Software Bill-of-Materials (SBOM) document was created on Thursday, July 30, 2026 with cdxgen. The data was captured during the pre-build lifecycle phase without building the application. The document describes an application named 'commander' with version '2.13.0'. The package type in this SBOM is npm with a single purl namespace '@types' described under components. The components were identified from the source files: package-lock.json."
    }
  ]
}