{ "bomFormat": "CycloneDX", "specVersion": "1.7", "serialNumber": "urn:uuid:94159cd4-1c9e-409c-9e19-46e89c0a580e", "version": 1, "metadata": { "timestamp": "2026-09-21T15:27:25Z", "tools": { "components": [ { "group": "@cyclonedx", "name": "cdxgen", "version": "12.8.4", "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.4", "type": "application", "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.4", "publisher": "OWASP Foundation", "authors": [ { "name": "OWASP Foundation" } ] } ] }, "authors": [ { "name": "OWASP Foundation" } ], "lifecycles": [ { "phase": "pre-build" } ], "component": { "name": "local-storage", "group": "@verdaccio", "version": "13.0.0-next-8.0", "description": "Local storage implementation", "purl": "pkg:npm/%40verdaccio/local-storage@13.0.0-next-8.0", "bom-ref": "pkg:npm/@verdaccio/local-storage@13.0.0-next-8.0", "author": "Juan Picado ", "properties": [ { "name": "cdx:npm:scripts", "value": "clean, test, type-check, build:types, build:js, watch, build" }, { "name": "cdx:npm:buildScripts", "value": "build:types, build:js, watch, build" }, { "name": "cdx:license:category", "value": "Permissive" } ], "type": "application", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "externalReferences": [ { "type": "website", "url": "https://verdaccio.org" }, { "type": "vcs", "url": "https://github.com/verdaccio/verdaccio" } ] }, "properties": [ { "name": "cdx:bom:componentTypes", "value": "npm" }, { "name": "cdx:bom:componentNamespaces", "value": "@types\\n@verdaccio" }, { "name": "cdx:bom:componentSrcFiles", "value": "node_modules/@types/minimatch/package.json\\nnode_modules/@verdaccio/config/package.json\\nnode_modules/@verdaccio/core/package.json\\nnode_modules/@verdaccio/file-locking/package.json\\nnode_modules/@verdaccio/logger/package.json\\nnode_modules/@verdaccio/test-helper/package.json\\nnode_modules/@verdaccio/types/package.json\\nnode_modules/@verdaccio/utils/package.json\\nnode_modules/core-js/package.json\\nnode_modules/debug/package.json\\nnode_modules/globby/package.json\\nnode_modules/lockfile/package.json\\nnode_modules/lodash/package.json\\nnode_modules/lowdb/package.json\\nnode_modules/lru-cache/package.json\\nnode_modules/minimatch/package.json\\nnode_modules/sanitize-filename/package.json" } ] }, "components": [ { "authors": [ { "name": "Parsha Pourkhomami" } ], "group": "", "name": "sanitize-filename", "version": "1.6.3", "description": "Sanitize a string for use as a filename", "scope": "required", "licenses": [ { "expression": "WTFPL OR ISC" } ], "purl": "pkg:npm/sanitize-filename@1.6.3", "type": "library", "bom-ref": "pkg:npm/sanitize-filename@1.6.3", "properties": [ { "name": "SrcFile", "value": "node_modules/sanitize-filename/package.json" }, { "name": "ImportedModules", "value": "sanitize-filename" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/sanitize-filename/package.json" } ], "concludedValue": "node_modules/sanitize-filename/package.json" } ], "occurrences": [ { "location": "build/local-fs.js", "line": 12 }, { "location": "src/local-fs.ts", "line": 5 }, { "location": "src/local-fs.ts", "line": 348 } ] } }, { "authors": [ { "name": "Isaac Z. Schlueter (http://blog.izs.me)" } ], "group": "", "name": "minimatch", "version": "9.0.5", "description": "a glob matcher in javascript", "scope": "optional", "licenses": [ { "license": { "id": "ISC", "url": "https://opensource.org/licenses/ISC", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/minimatch@9.0.5", "externalReferences": [ { "type": "vcs", "url": "git://github.com/isaacs/minimatch.git" } ], "type": "library", "bom-ref": "pkg:npm/minimatch@9.0.5", "properties": [ { "name": "SrcFile", "value": "node_modules/minimatch/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/minimatch/package.json" } ], "concludedValue": "node_modules/minimatch/package.json" } ] } }, { "authors": [ { "name": "Isaac Z. Schlueter " } ], "group": "", "name": "lru-cache", "version": "7.18.3", "description": "A cache object that deletes the least-recently-used items.", "scope": "optional", "licenses": [ { "license": { "id": "ISC", "url": "https://opensource.org/licenses/ISC", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/lru-cache@7.18.3", "type": "library", "bom-ref": "pkg:npm/lru-cache@7.18.3", "properties": [ { "name": "SrcFile", "value": "node_modules/lru-cache/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/lru-cache/package.json" } ], "concludedValue": "node_modules/lru-cache/package.json" } ] } }, { "authors": [ { "name": "Typicode " } ], "group": "", "name": "lowdb", "version": "1.0.0", "description": "Small JSON database for Node, Electron and the browser. Powered by Lodash.", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/lowdb@1.0.0", "externalReferences": [ { "type": "vcs", "url": "https://github.com/typicode/lowdb" }, { "type": "vcs", "url": "git://github.com/typicode/lowdb.git" } ], "type": "library", "bom-ref": "pkg:npm/lowdb@1.0.0", "properties": [ { "name": "SrcFile", "value": "node_modules/lowdb/package.json" }, { "name": "ImportedModules", "value": "lowdb,lowdb/adapters/FileAsync,lowdb/adapters/Memory" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/lowdb/package.json" } ], "concludedValue": "node_modules/lowdb/package.json" } ], "occurrences": [ { "location": "build/local-database.js", "line": 9 }, { "location": "build/local-database.js", "line": 10 }, { "location": "build/local-database.js", "line": 11 }, { "location": "src/local-database.ts", "line": 4 }, { "location": "src/local-database.ts", "line": 5 }, { "location": "src/local-database.ts", "line": 6 }, { "location": "src/local-database.ts", "line": 319 } ] }, "tags": [ "database", "json" ] }, { "authors": [ { "name": "John-David Dalton " } ], "group": "", "name": "lodash", "version": "4.17.21", "description": "Lodash modular utilities.", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/lodash@4.17.21", "externalReferences": [ { "type": "website", "url": "https://lodash.com/" } ], "type": "library", "bom-ref": "pkg:npm/lodash@4.17.21", "properties": [ { "name": "SrcFile", "value": "node_modules/lodash/package.json" }, { "name": "ImportedModules", "value": "lodash" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/lodash/package.json" } ], "concludedValue": "node_modules/lodash/package.json" } ], "occurrences": [ { "location": "build/local-database.js", "line": 8 }, { "location": "build/pkg-utils.js", "line": 7 }, { "location": "build/utils.js", "line": 11 }, { "location": "src/local-database.ts", "line": 3 }, { "location": "src/local-database.ts", "line": 203 }, { "location": "src/local-database.ts", "line": 272 }, { "location": "src/local-database.ts", "line": 330 }, { "location": "src/local-database.ts", "line": 345 }, { "location": "src/pkg-utils.ts", "line": 1 }, { "location": "src/pkg-utils.ts", "line": 16 }, { "location": "src/pkg-utils.ts", "line": 35 }, { "location": "src/utils.ts", "line": 2 }, { "location": "src/utils.ts", "line": 10 }, { "location": "src/utils.ts", "line": 21 } ] } }, { "authors": [ { "name": "Isaac Z. Schlueter (http://blog.izs.me/)" } ], "group": "", "name": "lockfile", "version": "1.0.4", "description": "A very polite lock file utility, which endeavors to not litter, and to wait patiently for others.", "scope": "optional", "licenses": [ { "license": { "id": "ISC", "url": "https://opensource.org/licenses/ISC", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/lockfile@1.0.4", "externalReferences": [ { "type": "vcs", "url": "https://github.com/npm/lockfile.git" } ], "type": "library", "bom-ref": "pkg:npm/lockfile@1.0.4", "properties": [ { "name": "SrcFile", "value": "node_modules/lockfile/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/lockfile/package.json" } ], "concludedValue": "node_modules/lockfile/package.json" } ] } }, { "authors": [ { "name": "Sindre Sorhus (https://sindresorhus.com)" } ], "group": "", "name": "globby", "version": "11.1.0", "description": "User-friendly glob matching", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/globby@11.1.0", "type": "library", "bom-ref": "pkg:npm/globby@11.1.0", "properties": [ { "name": "SrcFile", "value": "node_modules/globby/package.json" }, { "name": "ImportedModules", "value": "globby" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/globby/package.json" } ], "concludedValue": "node_modules/globby/package.json" } ], "occurrences": [ { "location": "build/dir-utils.js", "line": 9 }, { "location": "src/dir-utils.ts", "line": 2 }, { "location": "src/dir-utils.ts", "line": 16 } ] } }, { "authors": [ { "name": "Josh Junon (https://github.com/qix-)" } ], "group": "", "name": "debug", "version": "4.3.7", "description": "Lightweight debugging utility for Node.js and the browser", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/debug@4.3.7", "externalReferences": [ { "type": "vcs", "url": "git://github.com/debug-js/debug.git" } ], "type": "library", "bom-ref": "pkg:npm/debug@4.3.7", "properties": [ { "name": "SrcFile", "value": "node_modules/debug/package.json" }, { "name": "ImportedModules", "value": "debug" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/debug/package.json" } ], "concludedValue": "node_modules/debug/package.json" } ], "occurrences": [ { "location": "build/dir-utils.js", "line": 8 }, { "location": "build/local-database.js", "line": 7 }, { "location": "build/local-fs.js", "line": 9 }, { "location": "src/dir-utils.ts", "line": 1 }, { "location": "src/dir-utils.ts", "line": 7 }, { "location": "src/local-database.ts", "line": 2 }, { "location": "src/local-database.ts", "line": 22 }, { "location": "src/local-fs.ts", "line": 2 }, { "location": "src/local-fs.ts", "line": 32 } ] } }, { "authors": [ { "name": "Denis Pushkarev (http://zloirock.ru)" } ], "group": "", "name": "core-js", "version": "3.37.1", "description": "Standard library", "scope": "optional", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/core-js@3.37.1", "externalReferences": [ { "type": "vcs", "url": "https://github.com/zloirock/core-js.git" } ], "type": "library", "bom-ref": "pkg:npm/core-js@3.37.1", "properties": [ { "name": "SrcFile", "value": "node_modules/core-js/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/core-js/package.json" } ], "concludedValue": "node_modules/core-js/package.json" } ] } }, { "authors": [ { "name": "Juan Picado " } ], "group": "@verdaccio", "name": "utils", "version": "7.0.1-next-8.0", "description": "verdaccio utilities", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40verdaccio/utils@7.0.1-next-8.0", "externalReferences": [ { "type": "website", "url": "https://verdaccio.org" }, { "type": "vcs", "url": "https://github.com/verdaccio/verdaccio" } ], "type": "library", "bom-ref": "pkg:npm/@verdaccio/utils@7.0.1-next-8.0", "properties": [ { "name": "SrcFile", "value": "node_modules/@verdaccio/utils/package.json" }, { "name": "ImportedModules", "value": "@verdaccio/utils,getMatchedPackagesSpec,@verdaccio/utils/getMatchedPackagesSpec" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@verdaccio/utils/package.json" } ], "concludedValue": "node_modules/@verdaccio/utils/package.json" } ], "occurrences": [ { "location": "build/local-database.js", "line": 14 }, { "location": "src/local-database.ts", "line": 11 }, { "location": "src/local-database.ts", "line": 197 } ] } }, { "authors": [ { "name": "Juan Picado " } ], "group": "@verdaccio", "name": "types", "version": "13.0.0-next-8.0", "description": "verdaccio types definitions", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40verdaccio/types@13.0.0-next-8.0", "externalReferences": [ { "type": "website", "url": "https://verdaccio.org" }, { "type": "vcs", "url": "https://github.com/verdaccio/verdaccio" } ], "type": "library", "bom-ref": "pkg:npm/@verdaccio/types@13.0.0-next-8.0", "properties": [ { "name": "SrcFile", "value": "node_modules/@verdaccio/types/package.json" }, { "name": "ImportedModules", "value": "@verdaccio/types,Config,@verdaccio/types/Config,Logger,@verdaccio/types/Logger,Token,@verdaccio/types/Token,TokenFilter,@verdaccio/types/TokenFilter,Manifest,@verdaccio/types/Manifest,StorageList,@verdaccio/types/StorageList" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@verdaccio/types/package.json" } ], "concludedValue": "node_modules/@verdaccio/types/package.json" } ], "occurrences": [ { "location": "src/local-database.ts", "line": 10 }, { "location": "src/local-fs.ts", "line": 10 }, { "location": "src/pkg-utils.ts", "line": 3 }, { "location": "src/utils.ts", "line": 5 } ] } }, { "authors": [ { "name": "Juan Picado " } ], "group": "@verdaccio", "name": "test-helper", "version": "4.0.0-next-8.0", "description": "test helpers", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40verdaccio/test-helper@4.0.0-next-8.0", "externalReferences": [ { "type": "website", "url": "https://verdaccio.org" } ], "type": "library", "bom-ref": "pkg:npm/@verdaccio/test-helper@4.0.0-next-8.0", "properties": [ { "name": "SrcFile", "value": "node_modules/@verdaccio/test-helper/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@verdaccio/test-helper/package.json" } ], "concludedValue": "node_modules/@verdaccio/test-helper/package.json" } ] } }, { "authors": [ { "name": "Juan Picado " } ], "group": "@verdaccio", "name": "logger", "version": "8.0.0-next-8.0", "description": "logger", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40verdaccio/logger@8.0.0-next-8.0", "externalReferences": [ { "type": "website", "url": "https://verdaccio.org" }, { "type": "vcs", "url": "https://github.com/verdaccio/verdaccio" } ], "type": "library", "bom-ref": "pkg:npm/@verdaccio/logger@8.0.0-next-8.0", "properties": [ { "name": "SrcFile", "value": "node_modules/@verdaccio/logger/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@verdaccio/logger/package.json" } ], "concludedValue": "node_modules/@verdaccio/logger/package.json" } ] } }, { "authors": [ { "name": "Juan Picado " } ], "group": "@verdaccio", "name": "file-locking", "version": "13.0.0-next-8.0", "description": "library that handle file locking", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40verdaccio/file-locking@13.0.0-next-8.0", "externalReferences": [ { "type": "website", "url": "https://verdaccio.org" }, { "type": "vcs", "url": "https://github.com/verdaccio/verdaccio" } ], "type": "library", "bom-ref": "pkg:npm/@verdaccio/file-locking@13.0.0-next-8.0", "properties": [ { "name": "SrcFile", "value": "node_modules/@verdaccio/file-locking/package.json" }, { "name": "ImportedModules", "value": "@verdaccio/file-locking,readFileNext,@verdaccio/file-locking/readFileNext,unlockFileNext,@verdaccio/file-locking/unlockFileNext" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@verdaccio/file-locking/package.json" } ], "concludedValue": "node_modules/@verdaccio/file-locking/package.json" } ], "occurrences": [ { "location": "build/local-fs.js", "line": 15 }, { "location": "src/local-fs.ts", "line": 9 }, { "location": "src/local-fs.ts", "line": 407 }, { "location": "src/local-fs.ts", "line": 421 } ] } }, { "authors": [ { "name": "Juan Picado " } ], "group": "@verdaccio", "name": "core", "version": "8.0.0-next-8.0", "description": "core utilities", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40verdaccio/core@8.0.0-next-8.0", "externalReferences": [ { "type": "website", "url": "https://verdaccio.org" }, { "type": "vcs", "url": "https://github.com/verdaccio/verdaccio" } ], "type": "library", "bom-ref": "pkg:npm/@verdaccio/core@8.0.0-next-8.0", "properties": [ { "name": "SrcFile", "value": "node_modules/@verdaccio/core/package.json" }, { "name": "ImportedModules", "value": "@verdaccio/core,searchUtils,@verdaccio/core/searchUtils,validatioUtils,@verdaccio/core/validatioUtils,errorUtils,@verdaccio/core/errorUtils,fileUtils,@verdaccio/core/fileUtils,pluginUtils,@verdaccio/core/pluginUtils,VerdaccioError,@verdaccio/core/VerdaccioError" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@verdaccio/core/package.json" } ], "concludedValue": "node_modules/@verdaccio/core/package.json" } ], "occurrences": [ { "location": "build/dir-utils.js", "line": 11 }, { "location": "build/local-database.js", "line": 13 }, { "location": "build/local-fs.js", "line": 14 }, { "location": "src/dir-utils.ts", "line": 5 }, { "location": "src/dir-utils.ts", "line": 76 }, { "location": "src/dir-utils.ts", "line": 94 }, { "location": "src/local-database.ts", "line": 9 }, { "location": "src/local-database.ts", "line": 181 }, { "location": "src/local-database.ts", "line": 205 }, { "location": "src/local-fs.ts", "line": 8 }, { "location": "src/local-fs.ts", "line": 35 }, { "location": "src/local-fs.ts", "line": 120 }, { "location": "src/local-fs.ts", "line": 124 }, { "location": "src/local-fs.ts", "line": 126 }, { "location": "src/local-fs.ts", "line": 162 } ] } }, { "authors": [ { "name": "Juan Picado " } ], "group": "@verdaccio", "name": "config", "version": "8.0.0-next-8.0", "description": "logger", "scope": "required", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40verdaccio/config@8.0.0-next-8.0", "externalReferences": [ { "type": "website", "url": "https://verdaccio.org" }, { "type": "vcs", "url": "https://github.com/verdaccio/verdaccio" } ], "type": "library", "bom-ref": "pkg:npm/@verdaccio/config@8.0.0-next-8.0", "properties": [ { "name": "SrcFile", "value": "node_modules/@verdaccio/config/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@verdaccio/config/package.json" } ], "concludedValue": "node_modules/@verdaccio/config/package.json" } ] } }, { "group": "@types", "name": "minimatch", "version": "5.1.2", "description": "TypeScript definitions for minimatch", "scope": "excluded", "licenses": [ { "license": { "id": "MIT", "url": "https://opensource.org/licenses/MIT", "properties": [ { "name": "cdx:license:category", "value": "Permissive" }, { "name": "cdx:license:foss", "value": "true" }, { "name": "cdx:license:osiApproved", "value": "true" }, { "name": "cdx:license:fsfLibre", "value": "true" }, { "name": "cdx:license:deprecated", "value": "false" } ] } } ], "purl": "pkg:npm/%40types/minimatch@5.1.2", "externalReferences": [ { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/minimatch" }, { "type": "vcs", "url": "https://github.com/DefinitelyTyped/DefinitelyTyped.git" } ], "type": "library", "bom-ref": "pkg:npm/@types/minimatch@5.1.2", "properties": [ { "name": "SrcFile", "value": "node_modules/@types/minimatch/package.json" }, { "name": "cdx:license:category", "value": "Permissive" } ], "evidence": { "identity": [ { "field": "purl", "confidence": 0.7, "methods": [ { "technique": "manifest-analysis", "confidence": 0.7, "value": "node_modules/@types/minimatch/package.json" } ], "concludedValue": "node_modules/@types/minimatch/package.json" } ] } } ], "dependencies": [], "annotations": [ { "bom-ref": "metadata-annotations", "subjects": [ "pkg:npm/@verdaccio/local-storage@13.0.0-next-8.0" ], "annotator": { "component": { "group": "@cyclonedx", "name": "cdxgen", "version": "12.8.4", "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.4", "type": "application", "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.4", "publisher": "OWASP Foundation", "authors": [ { "name": "OWASP Foundation" } ] } }, "timestamp": "2026-09-21T15:27:25Z", "text": "This Software Bill-of-Materials (SBOM) document was created on Monday, September 21, 2026 with cdxgen. The data was captured during the pre-build lifecycle phase without building the application. The document describes an application named 'local-storage' with version '13.0.0-next-8.0'. The package type in this SBOM is npm with 2 purl namespaces described under components. The components were identified from 17 source files." } ] }