# cyclonedx-npm mit Homebrew installieren Prüfe Installationswege, Executables, Metadaten und Sicherheitshinweise für cyclonedx-npm in AI-Agent-Workflows. ## Installation ```sh sudo av install brew:cyclonedx-npm ``` Weitere Installationsbefehle: ### macOS - Homebrew (100%): ```sh brew install cyclonedx-npm ``` Evidenz: local Homebrew formula metadata ## Paketfakten - **Paketschlüssel:** brew:cyclonedx-npm - **Paketmanager:** Homebrew - **Version:** 6.0.0 - **Quellzusammenfassung:** Creates CycloneDX Software Bill of Materials (SBOM) from npm projects - **Homepage:** - **Zuletzt aktualisiert:** 2026-07-13T03:36:27Z - **Generiert:** 2026-08-03T19:37:03+00:00 ## Executables - cyclonedx-npm (Alias) ## Installationsverhalten - Bottle: nicht verfügbar ## Version und Aktualität - Seite generiert: 2026-08-03 - Manager-Version: 6.0.0 ## Projektgeschichte und Nutzung CycloneDX SBOM for npm is the CycloneDX project's command-line generator for producing CycloneDX Software Bill of Materials documents from Node.js npm projects. ### Projektgeschichte The project reached its first feature-complete beta in August 2022 and its first major release in September 2022. Its early releases focused on npm and npx execution, Windows usability, lock-file behavior, PackageURL output, and npm version compatibility. The 1.x series added SBOM validation, richer package evidence, CycloneDX specification support through 1.5, SCVS-oriented improvements, npm 10 and npm 11 support, workspace handling, and license-text gathering. Later major releases raised runtime requirements, changed default specification behavior, improved PackageURL generation, and addressed security issues in npm execution and workspace handling. ### Adoptionsgeschichte The official README documents installation as a global npm tool, via npx, or as a project development dependency, which places it directly in normal Node.js package-manager workflows. CycloneDX Tool Center lists CycloneDX for NPM as an open-source tool for JavaScript and Node.js across design, pre-build, build, post-build, and operations lifecycle phases. The supplied Homebrew input also shows it is packaged as the Homebrew formula cyclonedx-npm. ### Wie es verwendet wird The CLI defaults to reading package.json in the current project and can emit JSON or XML CycloneDX BOMs to stdout or to a selected output file. It can omit dependency classes, select workspaces, gather license text evidence, flatten components, choose a CycloneDX spec version, request reproducible output, and validate generated BOMs. The official docs explain that the tool uses npm-ls against the target project and interprets npm's output, with package.json files inside node_modules used as an additional evidence source when needed. ### Warum Paket-Nerds sich dafür interessieren For package maintainers and release engineers, cyclonedx-npm matters because it turns npm's installed dependency graph and package metadata into a portable SBOM artifact that can be checked into release pipelines, handed to vulnerability-management systems, or shared with downstream consumers. It sits at the intersection of npm, PackageURL, CycloneDX, and Homebrew packaging: the tool is itself distributed through package managers while producing package-centric metadata for supply-chain security workflows. ### Zeitleiste - 2022-08-20: First feature-complete implementation appeared as 1.0.0-beta.1. - 2022-09-24: First major version, 1.0.0, was released. - 2022-11-05: Support for npm v9 was enabled. - 2023-05-17: Version 1.12.0 added SCVS SBOM criteria-oriented improvements. - 2023-07-07: Version 1.13.0 added CycloneDX Specification 1.5 support. - 2025-01-27: Version 2.0.0 changed the default CycloneDX spec version to 1.6. - 2025-04-08: Version 3.0.0 dropped support for Node.js below 20.18.0 and npm below 9. - 2026-07-07: Version 6.0.0 fixed a workspace shell-injection vulnerability on Windows and reworked npm detection and handling. ### Related projects - CycloneDX is the underlying SBOM standard and OWASP project; TC54's official history records CycloneDX v1.0 in 2018 and ECMA-424 standardization in 2024. - The tool depends on the CycloneDX JavaScript library to build, serialize, and validate BOM data structures, and it is related to the wider CycloneDX family of package-ecosystem SBOM generators. ### Quellen - - - - - - source_facts.package-manager.brew ## Sicherheitshinweise Für cyclonedx-npm wurde kein passendes lokales Secret-Handling-Manifest gefunden. Nucleus-Paketmetadaten bleiben hier veröffentlicht, damit künftige Abdeckung eine stabile Paket-URL hat. ## Combined YAML source View the package source record on GitHub. [combined/cyclonedx-npm.yml](https://github.com/mxcl/pkgdb/blob/main/combined/cyclonedx-npm.yml) ## Quellen - pkg.so package database - curated package history - pkgdb category and tag curation - cross-ecosystem install command graph