{
  "bomFormat": "CycloneDX",
  "specVersion": "1.7",
  "serialNumber": "urn:uuid:087bf142-e115-4f10-9d53-f9d1f32c9e83",
  "version": 1,
  "metadata": {
    "timestamp": "2026-07-27T23:08:18Z",
    "tools": {
      "components": [
        {
          "group": "@cyclonedx",
          "name": "cdxgen",
          "version": "12.3.3",
          "purl": "pkg:npm/%40cyclonedx/cdxgen@12.3.3",
          "type": "application",
          "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.3.3",
          "publisher": "OWASP Foundation",
          "authors": [
            {
              "name": "OWASP Foundation"
            }
          ]
        }
      ]
    },
    "authors": [
      {
        "name": "OWASP Foundation"
      }
    ],
    "lifecycles": [
      {
        "phase": "pre-build"
      }
    ],
    "component": {
      "name": "modern-tar-benchmarks",
      "group": "",
      "version": "0.0.0",
      "purl": "pkg:npm/modern-tar-benchmarks@0.0.0",
      "bom-ref": "pkg:npm/modern-tar-benchmarks@0.0.0",
      "properties": [
        {
          "name": "cdx:npm:scripts",
          "value": "bench, bench:pack, bench:unpack, deopt, fixtures"
        }
      ],
      "type": "application"
    },
    "properties": [
      {
        "name": "cdx:bom:componentTypes",
        "value": "npm"
      },
      {
        "name": "cdx:bom:componentNamespaces",
        "value": "@isaacs\\n@types"
      },
      {
        "name": "cdx:bom:componentSrcFiles",
        "value": "benchmarks/package-lock.json"
      }
    ]
  },
  "components": [
    {
      "group": "",
      "name": "mitata",
      "version": "1.0.34",
      "scope": "required",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "31cdf3aed34128831e1d2090d17a912e8d6f6dd231d70bc557d73c349022ca1a3a02335f318f1b5616d2d766f072251d775b78ae3f34f7d087dcddcd15a85a50"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/mitata@1.0.34",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/mitata/-/mitata-1.0.34.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/mitata@1.0.34",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/mitata/-/mitata-1.0.34.tgz"
        },
        {
          "name": "ImportedModules",
          "value": "mitata,barplot,mitata/barplot,bench,mitata/bench,group,mitata/group,mitata/run,summary,mitata/summary"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ],
        "occurrences": [
          {
            "location": "benchmarks/pack.bench.ts#6"
          },
          {
            "location": "benchmarks/unpack.bench.ts#6"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "app",
      "version": "0.7.6",
      "scope": "optional",
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/app@0.7.6",
      "type": "library",
      "bom-ref": "pkg:npm/app@0.7.6",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "cdx:npm:resolvedPath",
          "value": ".."
        },
        {
          "name": "cdx:npm:isLink",
          "value": "true"
        },
        {
          "name": "cdx:npm:manifestSourceType",
          "value": "path"
        },
        {
          "name": "cdx:npm:manifestSource",
          "value": "file:.."
        },
        {
          "name": "cdx:npm:isRegistryDependency",
          "value": "false"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "tar",
      "version": "7.5.1",
      "scope": "required",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "9e51a9c5ffa1bf4bfb1a45812b657db2981a72d18ea74aaf7d647150c8ea1f2cebb774a0c04e3c0c8bff161a8f1c960b1e9816d68a6ade71116f3e409eaee7d6"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://opensource.org/licenses/ISC"
          }
        }
      ],
      "purl": "pkg:npm/tar@7.5.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/tar/-/tar-7.5.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/tar@7.5.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/tar/-/tar-7.5.1.tgz"
        },
        {
          "name": "ExportedModules",
          "value": "tar/types,DecoderOptions,.tar/types/DecoderOptions,TarEntryData,.tar/types/TarEntryData,TarHeader,.tar/types/TarHeader,UnpackOptions,.tar/types/UnpackOptions"
        },
        {
          "name": "ImportedModules",
          "value": "tar"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ],
        "occurrences": [
          {
            "location": "benchmarks/pack.bench.ts#8"
          },
          {
            "location": "benchmarks/unpack.bench.ts#8"
          }
        ]
      }
    },
    {
      "group": "@isaacs",
      "name": "fs-minipass",
      "version": "4.0.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "c209bd1219768e97aa3f7cf0ffb9a8de4447169e4c10386a01dc32d5f4c69070309e418e56c829bd084bf01e67d6a95bd358d5de7fdb23465f669e65580d64e3"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://opensource.org/licenses/ISC"
          }
        }
      ],
      "purl": "pkg:npm/%40isaacs/fs-minipass@4.0.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@isaacs/fs-minipass@4.0.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "minipass",
      "version": "7.1.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "a8e3b34b57014d6605e011fc7d578f0c138ef62a6d327194119c0d73f70c5a74d5da754b67b56835610f1e461ccd9034a5da00edd97a7bb14beb9f675fd4b66b"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://opensource.org/licenses/ISC"
          }
        }
      ],
      "purl": "pkg:npm/minipass@7.1.2",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/minipass/-/minipass-7.1.2.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/minipass@7.1.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/minipass/-/minipass-7.1.2.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "chownr",
      "version": "3.0.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "f88c7363d05939077f5ee60f466aef1158c5fe7aa3e64813e2412aed5a1fac3a0cd4cc6846311692b082dc4b4b8b9f5355ac314c09fea2b27015072ba84375fa"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "BlueOak-1.0.0",
            "url": "https://opensource.org/licenses/BlueOak-1.0.0"
          }
        }
      ],
      "purl": "pkg:npm/chownr@3.0.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/chownr@3.0.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "minizlib",
      "version": "3.1.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "299c58a350549160f64d514baf4310a0cf2f5148a0583dcb943f376bfef906a0bee2a1341dbd55a39bf516071f68d5ef7d7cebfb912143a8a783f09a0628d397"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/minizlib@3.1.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/minizlib/-/minizlib-3.1.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/minizlib@3.1.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/minizlib/-/minizlib-3.1.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "yallist",
      "version": "5.0.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "620bd44dfc2ac9ced45d532b07e4889ac5584a64d2f17fed4abb5d35930898cfa7efe413ae2457c978a6d2606b4d735eab3545d0a5868073de8b2562145acd0f"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "BlueOak-1.0.0",
            "url": "https://opensource.org/licenses/BlueOak-1.0.0"
          }
        }
      ],
      "purl": "pkg:npm/yallist@5.0.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/yallist@5.0.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "tar-fs",
      "version": "3.1.1",
      "scope": "required",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "2d9034a1a3ce7367d5a3cd93c5fde0c3e02411ddfcb33383969b4c61e8d05219dd1cc2d0f4cd39f6e5d1f807d2ec3368d0da4836f4aa0ecbf2682ac1564a6d5a"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/tar-fs@3.1.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/tar-fs/-/tar-fs-3.1.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/tar-fs@3.1.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/tar-fs/-/tar-fs-3.1.1.tgz"
        },
        {
          "name": "ImportedModules",
          "value": "tar-fs"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ],
        "occurrences": [
          {
            "location": "benchmarks/pack.bench.ts#9"
          },
          {
            "location": "benchmarks/unpack.bench.ts#9"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "pump",
      "version": "3.0.3",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "b68770c4b318eff85e49c2a69edc101bc09756459439d63122f636b34556000321fe777c4a862245a2a396befe882b3df387f63fccefadf59c0c36156fbdcd7c"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/pump@3.0.3",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/pump/-/pump-3.0.3.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/pump@3.0.3",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/pump/-/pump-3.0.3.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "end-of-stream",
      "version": "1.4.5",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "a2810673a1cfdbac57abf37e18218e4f424a08b0c6aead9b41466b43b832ac989900d27ff180d3c53a5005718c9fe59b2105cd569c96ca69bb2985480909f23a"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/end-of-stream@1.4.5",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/end-of-stream@1.4.5",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "once",
      "version": "1.4.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "94d689808fb643951140191c7042874d038f697754c67659125413658d0c15402e684a9ed44f8dcaf81dcff688c8d8ba67d3333b976fd47f27e7cfc610ba77fb"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://opensource.org/licenses/ISC"
          }
        }
      ],
      "purl": "pkg:npm/once@1.4.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/once/-/once-1.4.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/once@1.4.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/once/-/once-1.4.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "wrappy",
      "version": "1.0.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "9784a9fc346c7a8afdc0be84bd5dbe4ee427eb774c90f8d9feca7d5e48214c46d5f4a94f4b5c54b19deeeff2103b8c31b5c141e1b82940f45c477402bdeccf71"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://opensource.org/licenses/ISC"
          }
        }
      ],
      "purl": "pkg:npm/wrappy@1.0.2",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/wrappy@1.0.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "tar-stream",
      "version": "3.1.7",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "a898fad025edec853515fc9cdcd24c8e1e8492e0857a3e3acd4a89e09ee9a9895387277d6ced1705399c388852cd925559fb0b92cd3e9e57bf8f9dfc6005bd45"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/tar-stream@3.1.7",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/tar-stream/-/tar-stream-3.1.7.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/tar-stream@3.1.7",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/tar-stream/-/tar-stream-3.1.7.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "b4a",
      "version": "1.7.3",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "e50da67ead967c6b85a77b92fffd2ce9b68e24b32855db8f61578d983631bb9394035fdc05fbebd91212eef8bad8b74d8ffbab93585f9a3f3aec8deab7ab99ed"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://opensource.org/licenses/Apache-2.0"
          }
        }
      ],
      "purl": "pkg:npm/b4a@1.7.3",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/b4a/-/b4a-1.7.3.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/b4a@1.7.3",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/b4a/-/b4a-1.7.3.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "fast-fifo",
      "version": "1.3.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "fddf6c7e8b38cb1ce9c240e4b8dee4d92a852ad60d9824f381f129cfcdb1df820cf7fcdcf0a1b14285e0d6588d0bf8b3a5133f30176de38366c78d595aa93e15"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/fast-fifo@1.3.2",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/fast-fifo/-/fast-fifo-1.3.2.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/fast-fifo@1.3.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/fast-fifo/-/fast-fifo-1.3.2.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "streamx",
      "version": "2.23.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "927f9ee387ac55f9f615afced023c571ec76edf8c82fa32455a7b4326eaaf84e9fd215afe7bf1808445bbfee26d36723c6f0ec3ca2e79b1ada97fad1ea504c02"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/streamx@2.23.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/streamx/-/streamx-2.23.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/streamx@2.23.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/streamx/-/streamx-2.23.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "events-universal",
      "version": "1.0.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "2d47797aebdb30ba70385f26ea2bcf09b85079289854d6fc56cd1f43c4235e8d094e4107a73f29c5d41fd204ad96d68fa70d0271af1bdfd2b1bcaf5c7ca46203"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://opensource.org/licenses/Apache-2.0"
          }
        }
      ],
      "purl": "pkg:npm/events-universal@1.0.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/events-universal/-/events-universal-1.0.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/events-universal@1.0.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/events-universal/-/events-universal-1.0.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "bare-events",
      "version": "2.7.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "6f73797935b583bbd7930fb409787f1dacc64dc3b9298baefd108d6896c330f23a2c70e2fbba9ef049b129455ed6c51b636299395645ca3eb6c74384cfdab200"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://opensource.org/licenses/Apache-2.0"
          }
        }
      ],
      "purl": "pkg:npm/bare-events@2.7.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/bare-events/-/bare-events-2.7.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/bare-events@2.7.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/bare-events/-/bare-events-2.7.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "text-decoder",
      "version": "1.2.3",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "dffa3dcf75f45f47d3ba9c2c62f474de927f0e35aeaaaadfc018134337560e24129bd2a2b40cb3ffd5aab13d89416eca5769be6c2da897fceaa56dfb347c4b68"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://opensource.org/licenses/Apache-2.0"
          }
        }
      ],
      "purl": "pkg:npm/text-decoder@1.2.3",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/text-decoder/-/text-decoder-1.2.3.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/text-decoder@1.2.3",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/text-decoder/-/text-decoder-1.2.3.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "bare-fs",
      "version": "4.4.5",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "4c2b6ef772862eeebf6a2196cccaf5d93992452ea729d7e1027cd34116d7a125b191b6fd791779de3439d631bb8358188e3b6da3785b06bae1ce0e9d8dc8222a"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://opensource.org/licenses/Apache-2.0"
          }
        }
      ],
      "purl": "pkg:npm/bare-fs@4.4.5",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/bare-fs/-/bare-fs-4.4.5.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/bare-fs@4.4.5",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/bare-fs/-/bare-fs-4.4.5.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "bare-path",
      "version": "3.0.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "b727d6d9c41c07934df126a28eb86a9f4661ec09c536c9dccd172e58e0c7d1e6005c1b09e60571014b8dafbb6c1d20ba219efb700d128adcd3face3b928b7c33"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://opensource.org/licenses/Apache-2.0"
          }
        }
      ],
      "purl": "pkg:npm/bare-path@3.0.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/bare-path/-/bare-path-3.0.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/bare-path@3.0.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/bare-path/-/bare-path-3.0.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "bare-os",
      "version": "3.6.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "4fe575fb5b2b536a98341989097664518e6f43407815294bdd00d13a729060ea9e89047c51b8cd1e53daf9321b33872e89d88df4669368e66048482cbcf6e1e4"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://opensource.org/licenses/Apache-2.0"
          }
        }
      ],
      "purl": "pkg:npm/bare-os@3.6.2",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/bare-os/-/bare-os-3.6.2.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/bare-os@3.6.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/bare-os/-/bare-os-3.6.2.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "bare-stream",
      "version": "2.7.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "a325d0362715d72f2773668a7df1fe0541c54579b1e95acfce59da12f321ada9b49cf06b29c11d732060e6bd3c0f48bc5719e01c50225729f540a5e9486d01f0"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://opensource.org/licenses/Apache-2.0"
          }
        }
      ],
      "purl": "pkg:npm/bare-stream@2.7.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/bare-stream/-/bare-stream-2.7.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/bare-stream@2.7.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/bare-stream/-/bare-stream-2.7.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "bare-url",
      "version": "2.2.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "83eb9e3462a4ae331acc31b77a564ed6936cdc7639fa632639eb758ed2b284e6829e42f38adc5fdbacfb86800490336074d9a773528896dfddc3a3e8eb164ca4"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://opensource.org/licenses/Apache-2.0"
          }
        }
      ],
      "purl": "pkg:npm/bare-url@2.2.2",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/bare-url/-/bare-url-2.2.2.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/bare-url@2.2.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/bare-url/-/bare-url-2.2.2.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "@types",
      "name": "node",
      "version": "24.5.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "158c64d48ef03efdcad9705aa321f67139e871012ef00399eb484f6eccae90c3cbbf9ff9aabed5d62f0f2c7765e997fcec8fb165716f3c25d88e24c5abe6120d"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/%40types/node@24.5.2",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/@types/node/-/node-24.5.2.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@types/node@24.5.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/@types/node/-/node-24.5.2.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "undici-types",
      "version": "7.12.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "82839a72a304d8663239965f6f92e0b6efb520398094012ee719c3dfec53cd2d74853d2fce97f448f8e45f0030f499bee27fe64060cfdcb3bc08f6d844e7817d"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/undici-types@7.12.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/undici-types/-/undici-types-7.12.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/undici-types@7.12.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/undici-types/-/undici-types-7.12.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "@types",
      "name": "tar",
      "version": "6.1.13",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "2339e79665397f859c19387696d46efc88e99a4f308965df174540e2cf873e31d982f160824d5868891ba3992b5ffcd40b3585f0dfe5e3e5bf2cdc67bc027c9f"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/%40types/tar@6.1.13",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/@types/tar/-/tar-6.1.13.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@types/tar@6.1.13",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/@types/tar/-/tar-6.1.13.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "minipass",
      "version": "4.2.8",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "7cdcee57289fa2548b14be0dce917ec04178aab82a69a297d216973d011d43b34a00df9679ca0a307574f5872e2ff0c7c6b52c61038adcc8ae0dfec8a763977d"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://opensource.org/licenses/ISC"
          }
        }
      ],
      "purl": "pkg:npm/minipass@4.2.8",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/minipass/-/minipass-4.2.8.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/minipass@4.2.8",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/minipass/-/minipass-4.2.8.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "@types",
      "name": "tar-fs",
      "version": "2.0.4",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "8a93de7340a34e6543584f902abf5c4e6208a1397b7451bfc8044233932a2bc8ba08d2c81b53fcc789300ec3906350a164e6631f4c0ef67bdf801bd697847790"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/%40types/tar-fs@2.0.4",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/@types/tar-fs/-/tar-fs-2.0.4.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@types/tar-fs@2.0.4",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/@types/tar-fs/-/tar-fs-2.0.4.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "@types",
      "name": "tar-stream",
      "version": "3.1.4",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "f76d605b4fa0dbd982257d1f46fa9e1f306513f5dc9436801b43aeb32d4b0a086c3a1bda29a70379118457340ff483df2a7f15caccbb1445c0231c9ca5cfc232"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/%40types/tar-stream@3.1.4",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/@types/tar-stream/-/tar-stream-3.1.4.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@types/tar-stream@3.1.4",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/@types/tar-stream/-/tar-stream-3.1.4.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "typescript",
      "version": "5.9.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "0960735d0adcfea3a4862770d4ecc14d0b9845b7f2c435c93152755cdc141c644e566b9a7a2126dceb25a59d5157de9ded228a8d92ab489bb7fadff1970dd1f4"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://opensource.org/licenses/Apache-2.0"
          }
        }
      ],
      "purl": "pkg:npm/typescript@5.9.2",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/typescript/-/typescript-5.9.2.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/typescript@5.9.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "benchmarks/package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/typescript/-/typescript-5.9.2.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "benchmarks/package-lock.json"
              }
            ],
            "concludedValue": "benchmarks/package-lock.json"
          }
        ]
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/mitata@1.0.34",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/app@0.7.6",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/minipass@7.1.2",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/@isaacs/fs-minipass@4.0.1",
      "dependsOn": [
        "pkg:npm/minipass@7.1.2"
      ]
    },
    {
      "ref": "pkg:npm/chownr@3.0.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/minizlib@3.1.0",
      "dependsOn": [
        "pkg:npm/minipass@7.1.2"
      ]
    },
    {
      "ref": "pkg:npm/yallist@5.0.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/tar@7.5.1",
      "dependsOn": [
        "pkg:npm/@isaacs/fs-minipass@4.0.1",
        "pkg:npm/chownr@3.0.0",
        "pkg:npm/minipass@7.1.2",
        "pkg:npm/minizlib@3.1.0",
        "pkg:npm/yallist@5.0.0"
      ]
    },
    {
      "ref": "pkg:npm/wrappy@1.0.2",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/once@1.4.0",
      "dependsOn": [
        "pkg:npm/wrappy@1.0.2"
      ]
    },
    {
      "ref": "pkg:npm/end-of-stream@1.4.5",
      "dependsOn": [
        "pkg:npm/once@1.4.0"
      ]
    },
    {
      "ref": "pkg:npm/pump@3.0.3",
      "dependsOn": [
        "pkg:npm/end-of-stream@1.4.5",
        "pkg:npm/once@1.4.0"
      ]
    },
    {
      "ref": "pkg:npm/b4a@1.7.3",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/fast-fifo@1.3.2",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/bare-events@2.7.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/events-universal@1.0.1",
      "dependsOn": [
        "pkg:npm/bare-events@2.7.0"
      ]
    },
    {
      "ref": "pkg:npm/text-decoder@1.2.3",
      "dependsOn": [
        "pkg:npm/b4a@1.7.3"
      ]
    },
    {
      "ref": "pkg:npm/streamx@2.23.0",
      "dependsOn": [
        "pkg:npm/events-universal@1.0.1",
        "pkg:npm/fast-fifo@1.3.2",
        "pkg:npm/text-decoder@1.2.3"
      ]
    },
    {
      "ref": "pkg:npm/tar-stream@3.1.7",
      "dependsOn": [
        "pkg:npm/b4a@1.7.3",
        "pkg:npm/fast-fifo@1.3.2",
        "pkg:npm/streamx@2.23.0"
      ]
    },
    {
      "ref": "pkg:npm/bare-os@3.6.2",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/bare-path@3.0.0",
      "dependsOn": [
        "pkg:npm/bare-os@3.6.2"
      ]
    },
    {
      "ref": "pkg:npm/bare-stream@2.7.0",
      "dependsOn": [
        "pkg:npm/bare-events@2.7.0",
        "pkg:npm/streamx@2.23.0"
      ]
    },
    {
      "ref": "pkg:npm/bare-url@2.2.2",
      "dependsOn": [
        "pkg:npm/bare-path@3.0.0"
      ]
    },
    {
      "ref": "pkg:npm/bare-fs@4.4.5",
      "dependsOn": [
        "pkg:npm/bare-events@2.7.0",
        "pkg:npm/bare-path@3.0.0",
        "pkg:npm/bare-stream@2.7.0",
        "pkg:npm/bare-url@2.2.2",
        "pkg:npm/fast-fifo@1.3.2"
      ]
    },
    {
      "ref": "pkg:npm/tar-fs@3.1.1",
      "dependsOn": [
        "pkg:npm/bare-fs@4.4.5",
        "pkg:npm/bare-path@3.0.0",
        "pkg:npm/pump@3.0.3",
        "pkg:npm/tar-stream@3.1.7"
      ]
    },
    {
      "ref": "pkg:npm/undici-types@7.12.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/@types/node@24.5.2",
      "dependsOn": [
        "pkg:npm/undici-types@7.12.0"
      ]
    },
    {
      "ref": "pkg:npm/minipass@4.2.8",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/@types/tar@6.1.13",
      "dependsOn": [
        "pkg:npm/@types/node@24.5.2",
        "pkg:npm/minipass@4.2.8"
      ]
    },
    {
      "ref": "pkg:npm/@types/tar-stream@3.1.4",
      "dependsOn": [
        "pkg:npm/@types/node@24.5.2"
      ]
    },
    {
      "ref": "pkg:npm/@types/tar-fs@2.0.4",
      "dependsOn": [
        "pkg:npm/@types/node@24.5.2",
        "pkg:npm/@types/tar-stream@3.1.4"
      ]
    },
    {
      "ref": "pkg:npm/typescript@5.9.2",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/modern-tar-benchmarks@0.0.0",
      "dependsOn": [
        "pkg:npm/@types/node@24.5.2",
        "pkg:npm/@types/tar-fs@2.0.4",
        "pkg:npm/@types/tar@6.1.13",
        "pkg:npm/app@0.7.6",
        "pkg:npm/mitata@1.0.34",
        "pkg:npm/tar-fs@3.1.1",
        "pkg:npm/tar@7.5.1",
        "pkg:npm/typescript@5.9.2"
      ]
    }
  ],
  "annotations": [
    {
      "bom-ref": "metadata-annotations",
      "subjects": [
        "pkg:npm/modern-tar-benchmarks@0.0.0"
      ],
      "annotator": {
        "component": {
          "group": "@cyclonedx",
          "name": "cdxgen",
          "version": "12.3.3",
          "purl": "pkg:npm/%40cyclonedx/cdxgen@12.3.3",
          "type": "application",
          "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.3.3",
          "publisher": "OWASP Foundation",
          "authors": [
            {
              "name": "OWASP Foundation"
            }
          ]
        }
      },
      "timestamp": "2026-07-27T23:08:18Z",
      "text": "This Software Bill-of-Materials (SBOM) document was created on Monday, July 27, 2026 with cdxgen. The data was captured during the pre-build lifecycle phase without building the application. The document describes an application named 'modern-tar-benchmarks' with version '0.0.0'. The package type in this SBOM is npm with 2 purl namespaces described under components. The components were identified from the source files: benchmarks/package-lock.json."
    }
  ]
}