@cyclonedx/cyclonedx-npm

Create CycloneDX Software Bill of Materials (SBOM) from NPM projects.

Latest 6.0.1

NPM

85%

Total Score

Maintainer Stability

Dependencies

100

Maturity

100

Supply Chain

Attestations

100

Are you affected? Scan for Free

Health Score Breakdown

Lifecycle scripts

A prepublish script is present, creating some packaging-process exposure, but the provided evidence does not show a dangerous install-time script or unexplained runtime behavior.

Repo bus factor

One contributor made all 28 commits in the last 3 months, so current maintenance is highly concentrated. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Vulnerabilities

Title	Versions	Severity
CVE-2026-71538 @cyclonedx/cyclonedx-npm is vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in versions 0.0.0 - 6.0.0.	0.0.0 - 6.0.0	High
CVE-2026-55849 @cyclonedx/cyclonedx-npm is vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in versions 2.1.0 - 5.0.0.	2.1.0 - 5.0.0	High
AIKIDO-2024-10116 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @cyclonedx/cyclonedx-npm is vulnerable to Information Disclosure in versions 1.0.0 - 1.18.0.	1.0.0 - 1.18.0	Low

Package versions

Maintainers

Direct Dependencies

Dependency	Last Release	Score
commander Version ^14.0.0	—	—
xmlbuilder2 Version ^3.0.2 \|\| ^4.0.3	—	—
packageurl-js Version ^2.0.1	—	—
spdx-expression-parse Version ^3.0.1 \|\| ^4.0.0	—	—
normalize-package-data Version ^7.0.0 \|\| ^8.0.0	—	—