# 使用 Homebrew 安装 cyclonedx-npm 查看 cyclonedx-npm 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。 ## 安装 ```sh sudo av install brew:cyclonedx-npm ``` 其他安装命令: ### macOS - Homebrew (100%): ```sh brew install cyclonedx-npm ``` 证据: local Homebrew formula metadata ## 软件包事实 - **软件包键:** brew:cyclonedx-npm - **软件包管理器:** Homebrew - **版本:** 6.0.0 - **来源摘要:** Creates CycloneDX Software Bill of Materials (SBOM) from npm projects - **主页:** - **最后更新:** 2026-07-13T03:36:27Z - **已生成:** 2026-08-03T19:37:03+00:00 ## 可执行文件 - cyclonedx-npm (别名) ## 安装行为 - Bottle: 不可用 ## 版本和新鲜度 - 页面生成时间: 2026-08-03 - 管理器版本: 6.0.0 ## 项目历史与用法 CycloneDX SBOM for npm is the CycloneDX project's command-line generator for producing CycloneDX Software Bill of Materials documents from Node.js npm projects. ### 项目历史 The project reached its first feature-complete beta in August 2022 and its first major release in September 2022. Its early releases focused on npm and npx execution, Windows usability, lock-file behavior, PackageURL output, and npm version compatibility. The 1.x series added SBOM validation, richer package evidence, CycloneDX specification support through 1.5, SCVS-oriented improvements, npm 10 and npm 11 support, workspace handling, and license-text gathering. Later major releases raised runtime requirements, changed default specification behavior, improved PackageURL generation, and addressed security issues in npm execution and workspace handling. ### 采用历史 The official README documents installation as a global npm tool, via npx, or as a project development dependency, which places it directly in normal Node.js package-manager workflows. CycloneDX Tool Center lists CycloneDX for NPM as an open-source tool for JavaScript and Node.js across design, pre-build, build, post-build, and operations lifecycle phases. The supplied Homebrew input also shows it is packaged as the Homebrew formula cyclonedx-npm. ### 使用方式 The CLI defaults to reading package.json in the current project and can emit JSON or XML CycloneDX BOMs to stdout or to a selected output file. It can omit dependency classes, select workspaces, gather license text evidence, flatten components, choose a CycloneDX spec version, request reproducible output, and validate generated BOMs. The official docs explain that the tool uses npm-ls against the target project and interprets npm's output, with package.json files inside node_modules used as an additional evidence source when needed. ### 为什么软件包爱好者会关心 For package maintainers and release engineers, cyclonedx-npm matters because it turns npm's installed dependency graph and package metadata into a portable SBOM artifact that can be checked into release pipelines, handed to vulnerability-management systems, or shared with downstream consumers. It sits at the intersection of npm, PackageURL, CycloneDX, and Homebrew packaging: the tool is itself distributed through package managers while producing package-centric metadata for supply-chain security workflows. ### 时间线 - 2022-08-20: First feature-complete implementation appeared as 1.0.0-beta.1. - 2022-09-24: First major version, 1.0.0, was released. - 2022-11-05: Support for npm v9 was enabled. - 2023-05-17: Version 1.12.0 added SCVS SBOM criteria-oriented improvements. - 2023-07-07: Version 1.13.0 added CycloneDX Specification 1.5 support. - 2025-01-27: Version 2.0.0 changed the default CycloneDX spec version to 1.6. - 2025-04-08: Version 3.0.0 dropped support for Node.js below 20.18.0 and npm below 9. - 2026-07-07: Version 6.0.0 fixed a workspace shell-injection vulnerability on Windows and reworked npm detection and handling. ### Related projects - CycloneDX is the underlying SBOM standard and OWASP project; TC54's official history records CycloneDX v1.0 in 2018 and ECMA-424 standardization in 2024. - The tool depends on the CycloneDX JavaScript library to build, serialize, and validate BOM data structures, and it is related to the wider CycloneDX family of package-ecosystem SBOM generators. ### 来源 - - - - - - source_facts.package-manager.brew ## 安全说明 没有找到 cyclonedx-npm 的匹配本地密钥处理 manifest。Nucleus 软件包元数据仍在此发布，以便未来覆盖拥有稳定的软件包 URL。 ## Combined YAML source View the package source record on GitHub. [combined/cyclonedx-npm.yml](https://github.com/mxcl/pkgdb/blob/main/combined/cyclonedx-npm.yml) ## 来源 - pkg.so package database - curated package history - pkgdb category and tag curation - cross-ecosystem install command graph