# Installer cyclonedx-npm avec Homebrew Consultez les chemins d'installation, exécutables, métadonnées et notes de sécurité de cyclonedx-npm pour les workflows d'agents IA. ## installation ```sh sudo av install brew:cyclonedx-npm ``` Commandes d'installation supplémentaires: ### macOS - Homebrew (100%): ```sh brew install cyclonedx-npm ``` Preuve: local Homebrew formula metadata ## Faits du paquet - **Clé du paquet:** brew:cyclonedx-npm - **Gestionnaire de paquets:** Homebrew - **Page du gestionnaire de paquets:** - **Version:** 6.0.0 - **Résumé source:** Creates CycloneDX Software Bill of Materials (SBOM) from npm projects - **Page d'accueil:** - **Dépôt:** - **Docs amont:** - **Licence:** Apache-2.0 - **Archive source:** - **Dernière mise à jour:** 2026-07-13T03:36:27Z - **Généré:** 2026-07-25T07:20:51+00:00 ## exécutables - cyclonedx-npm (cli) - cyclonedx-npm (alias) ## Dépendances - node ## Comportement d'installation - hook post-installation: non défini - Bouteille: disponible sur all ## Version et fraîcheur - page générée: 2026-07-25 - version du gestionnaire: 6.0.0 - gestionnaire mis à jour: 2026-07-13 - données locales: OK - dépôt amont: https://github.com/CycloneDX/cyclonedx-node-npm - info: No cached GitHub release or tag data was available. ## Historique du projet et usages CycloneDX SBOM for npm is the CycloneDX project's command-line generator for producing CycloneDX Software Bill of Materials documents from Node.js npm projects. ### Historique du projet The project reached its first feature-complete beta in August 2022 and its first major release in September 2022. Its early releases focused on npm and npx execution, Windows usability, lock-file behavior, PackageURL output, and npm version compatibility. The 1.x series added SBOM validation, richer package evidence, CycloneDX specification support through 1.5, SCVS-oriented improvements, npm 10 and npm 11 support, workspace handling, and license-text gathering. Later major releases raised runtime requirements, changed default specification behavior, improved PackageURL generation, and addressed security issues in npm execution and workspace handling. ### Historique d'adoption The official README documents installation as a global npm tool, via npx, or as a project development dependency, which places it directly in normal Node.js package-manager workflows. CycloneDX Tool Center lists CycloneDX for NPM as an open-source tool for JavaScript and Node.js across design, pre-build, build, post-build, and operations lifecycle phases. The supplied Homebrew input also shows it is packaged as the Homebrew formula cyclonedx-npm. ### Modes d'utilisation The CLI defaults to reading package.json in the current project and can emit JSON or XML CycloneDX BOMs to stdout or to a selected output file. It can omit dependency classes, select workspaces, gather license text evidence, flatten components, choose a CycloneDX spec version, request reproducible output, and validate generated BOMs. The official docs explain that the tool uses npm-ls against the target project and interprets npm's output, with package.json files inside node_modules used as an additional evidence source when needed. ### Pourquoi les passionnés de paquets s'y intéressent For package maintainers and release engineers, cyclonedx-npm matters because it turns npm's installed dependency graph and package metadata into a portable SBOM artifact that can be checked into release pipelines, handed to vulnerability-management systems, or shared with downstream consumers. It sits at the intersection of npm, PackageURL, CycloneDX, and Homebrew packaging: the tool is itself distributed through package managers while producing package-centric metadata for supply-chain security workflows. ### Chronologie - 2022-08-20: First feature-complete implementation appeared as 1.0.0-beta.1. - 2022-09-24: First major version, 1.0.0, was released. - 2022-11-05: Support for npm v9 was enabled. - 2023-05-17: Version 1.12.0 added SCVS SBOM criteria-oriented improvements. - 2023-07-07: Version 1.13.0 added CycloneDX Specification 1.5 support. - 2025-01-27: Version 2.0.0 changed the default CycloneDX spec version to 1.6. - 2025-04-08: Version 3.0.0 dropped support for Node.js below 20.18.0 and npm below 9. - 2026-07-07: Version 6.0.0 fixed a workspace shell-injection vulnerability on Windows and reworked npm detection and handling. ### Related projects - CycloneDX is the underlying SBOM standard and OWASP project; TC54's official history records CycloneDX v1.0 in 2018 and ECMA-424 standardization in 2024. - The tool depends on the CycloneDX JavaScript library to build, serialize, and validate BOM data structures, and it is related to the wider CycloneDX family of package-ecosystem SBOM generators. ### Sources - - - - - - source_facts.package-manager.brew ## Notes de sécurité Aucun manifest local de gestion des secrets correspondant n'a été trouvé pour cyclonedx-npm. Les métadonnées de paquet Nucleus restent publiées ici afin que la couverture future dispose d'une URL stable. ## Détails de la base source - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** cyclonedx-npm - **Version Scheme:** 0 - **Revision:** 0 - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## Liens liés - [Source-control packages](https://www.automicvault.com/fr/pkg/source-control-tools/) - Belongs to a source-control command family. - [Package publisher tools](https://www.automicvault.com/fr/pkg/package-publishers/) - Belongs to a package publishing or registry command family. - [Terminal utility packages](https://www.automicvault.com/fr/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Language runtime packages](https://www.automicvault.com/fr/pkg/language-runtime-packages/) - Matched language runtime, compiler, or interpreter metadata. - [node](https://www.automicvault.com/fr/pkg/brew/node/) - Runtime dependency declared by Homebrew. - [cyclonedx-gomod](https://www.automicvault.com/fr/pkg/brew/cyclonedx-gomod/) - Shares av.db curated category or tags: cli, cyclonedx, sbom, security, software-supply-chain. - [cyclonedx-python](https://www.automicvault.com/fr/pkg/brew/cyclonedx-python/) - Shares av.db curated category or tags: cli, cyclonedx, sbom, security, software-supply-chain. - [bomctl](https://www.automicvault.com/fr/pkg/brew/bomctl/) - Shares av.db curated category or tags: cli, cyclonedx, sbom, security, software-supply-chain. - [cyclonedx-cli](https://www.automicvault.com/fr/pkg/brew/cyclonedx-cli/) - Shares av.db curated category or tags: cli, cyclonedx, sbom, security, software-supply-chain. - [sbom-tool](https://www.automicvault.com/fr/pkg/brew/sbom-tool/) - Shares av.db curated category or tags: cli, sbom, security, software-supply-chain. - [cdxgen](https://www.automicvault.com/fr/pkg/brew/cdxgen/) - Shares av.db curated category or tags: cli, cyclonedx, sbom, security, software-supply-chain. - [chainloop-cli](https://www.automicvault.com/fr/pkg/brew/chainloop-cli/) - Shares av.db curated category or tags: cli, sbom, security, software-supply-chain. - [phylum-cli](https://www.automicvault.com/fr/pkg/brew/phylum-cli/) - Shares av.db curated category or tags: cli, security, software-supply-chain. ## Combined YAML source View the package source record on GitHub. [combined/cyclonedx-npm.yml](https://github.com/automic-vault/db/blob/main/combined/cyclonedx-npm.yml) ## Sources - Nucleus package database - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - cross-ecosystem install command graph