Install cyclonedx-npm with Homebrew

Project links

• Homepage
• Upstream docs
• Package manager page

Commands and aliases

• cyclonedx-npm

Project history

The project reached its first feature-complete beta in August 2022 and its first major release in September 2022. Its early releases focused on npm and npx execution, Windows usability, lock-file behavior, PackageURL output, and npm version compatibility.

The 1.x series added SBOM validation, richer package evidence, CycloneDX specification support through 1.5, SCVS-oriented improvements, npm 10 and npm 11 support, workspace handling, and license-text gathering. Later major releases raised runtime requirements, changed default specification behavior, improved PackageURL generation, and addressed security issues in npm execution and workspace handling.

Adoption history

The official README documents installation as a global npm tool, via npx, or as a project development dependency, which places it directly in normal Node.js package-manager workflows.

CycloneDX Tool Center lists CycloneDX for NPM as an open-source tool for JavaScript and Node.js across design, pre-build, build, post-build, and operations lifecycle phases. The supplied Homebrew input also shows it is packaged as the Homebrew formula cyclonedx-npm.

How it is used

The CLI defaults to reading package.json in the current project and can emit JSON or XML CycloneDX BOMs to stdout or to a selected output file. It can omit dependency classes, select workspaces, gather license text evidence, flatten components, choose a CycloneDX spec version, request reproducible output, and validate generated BOMs.

The official docs explain that the tool uses npm-ls against the target project and interprets npm's output, with package.json files inside node_modules used as an additional evidence source when needed.

Why package nerds care

For package maintainers and release engineers, cyclonedx-npm matters because it turns npm's installed dependency graph and package metadata into a portable SBOM artifact that can be checked into release pipelines, handed to vulnerability-management systems, or shared with downstream consumers.

It sits at the intersection of npm, PackageURL, CycloneDX, and Homebrew packaging: the tool is itself distributed through package managers while producing package-centric metadata for supply-chain security workflows.

Timeline

• 2022-08-20: First feature-complete implementation appeared as 1.0.0-beta.1.
• 2022-09-24: First major version, 1.0.0, was released.
• 2022-11-05: Support for npm v9 was enabled.
• 2023-05-17: Version 1.12.0 added SCVS SBOM criteria-oriented improvements.
• 2023-07-07: Version 1.13.0 added CycloneDX Specification 1.5 support.
• 2025-01-27: Version 2.0.0 changed the default CycloneDX spec version to 1.6.
• 2025-04-08: Version 3.0.0 dropped support for Node.js below 20.18.0 and npm below 9.
• 2026-07-07: Version 6.0.0 fixed a workspace shell-injection vulnerability on Windows and reworked npm detection and handling.

Related projects

• CycloneDX is the underlying SBOM standard and OWASP project; TC54's official history records CycloneDX v1.0 in 2018 and ECMA-424 standardization in 2024.
• The tool depends on the CycloneDX JavaScript library to build, serialize, and validate BOM data structures, and it is related to the wider CycloneDX family of package-ecosystem SBOM generators.

Sources

• https://cyclonedx.org/tool-center/
• https://github.com/CycloneDX/cyclonedx-node-npm
• https://github.com/CycloneDX/cyclonedx-node-npm/blob/main/HISTORY.md
• https://github.com/CycloneDX/cyclonedx-node-npm/blob/main/docs/how.md
• https://tc54.org/history/
• source_facts.package-manager.brew