{
  "bomFormat": "CycloneDX",
  "specVersion": "1.7",
  "serialNumber": "urn:uuid:0171027d-3df7-4375-aaf1-1cce465a778c",
  "version": 1,
  "metadata": {
    "timestamp": "2026-09-09T18:22:20Z",
    "tools": {
      "components": [
        {
          "group": "@cyclonedx",
          "name": "cdxgen",
          "version": "12.8.4",
          "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.4",
          "type": "application",
          "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.4",
          "publisher": "OWASP Foundation",
          "authors": [
            {
              "name": "OWASP Foundation"
            }
          ]
        }
      ]
    },
    "authors": [
      {
        "name": "OWASP Foundation"
      }
    ],
    "lifecycles": [
      {
        "phase": "pre-build"
      }
    ],
    "component": {
      "name": "needle",
      "group": "",
      "version": "3.3.1",
      "description": "The leanest and most handsome HTTP client in the Nodelands.",
      "purl": "pkg:npm/needle@3.3.1",
      "bom-ref": "pkg:npm/needle@3.3.1",
      "author": "Tomás Pollak <tomas@forkhq.com>",
      "properties": [
        {
          "name": "cdx:npm:bin",
          "value": "needle"
        },
        {
          "name": "cdx:npm:has_binary",
          "value": "true"
        },
        {
          "name": "cdx:npm:scripts",
          "value": "test"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "type": "application",
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "externalReferences": [
        {
          "type": "vcs",
          "url": "https://github.com/tomas/needle.git"
        }
      ]
    },
    "properties": [
      {
        "name": "cdx:bom:componentTypes",
        "value": "npm"
      },
      {
        "name": "cdx:bom:componentSrcFiles",
        "value": "package-lock.json"
      }
    ]
  },
  "components": [
    {
      "group": "",
      "name": "iconv-lite",
      "version": "0.6.3",
      "scope": "required",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "e1f0a4efdc2c84c773329dab1f4eaa5ab244e22a25a8b842507f8e8ae22053ef91074fbde0d9432fcd5ab4eec65f9e6e50ab9ea34b711cdb6f13223a0fb59d33"
        }
      ],
      "purl": "pkg:npm/iconv-lite@0.6.3",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/iconv-lite@0.6.3",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz"
        },
        {
          "name": "ImportedModules",
          "value": "iconv-lite"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ],
        "occurrences": [
          {
            "location": "lib/decoder.js",
            "line": 53
          }
        ]
      }
    },
    {
      "group": "",
      "name": "safer-buffer",
      "version": "2.1.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "619a372bcd920fb462ca2d04d4440fa232f3ee4a5ea6749023d2323db1c78355d75debdbe5d248eeda72376003c467106c71bbbdcc911e4d1c6f0a9c42b894b6"
        }
      ],
      "purl": "pkg:npm/safer-buffer@2.1.2",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/safer-buffer@2.1.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "sax",
      "version": "1.2.4",
      "scope": "required",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2816234e2378bddc4e5354fab5caa895df7100d9"
        }
      ],
      "purl": "pkg:npm/sax@1.2.4",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/sax/-/sax-1.2.4.tgz"
        }
      ],
      "type": "framework",
      "bom-ref": "pkg:npm/sax@1.2.4",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/sax/-/sax-1.2.4.tgz"
        },
        {
          "name": "ImportedModules",
          "value": "sax"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ],
        "occurrences": [
          {
            "location": "lib/parsers.js",
            "line": 7
          }
        ]
      },
      "tags": [
        "framework"
      ]
    },
    {
      "group": "",
      "name": "JSONStream",
      "version": "1.3.5",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "13e8abb8d398f1557db382446ded5a3449ba322b333d1aff51f707333d13421d415d2c472be01257547a5b81e98c1852792fb9e0f22c00c0819b00f4e8b2eca9"
        }
      ],
      "purl": "pkg:npm/JSONStream@1.3.5",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/JSONStream/-/JSONStream-1.3.5.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/JSONStream@1.3.5",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/JSONStream/-/JSONStream-1.3.5.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "jsonparse",
      "version": "1.3.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3f4dae4a91fac315f71062f8521cc239f1366280"
        }
      ],
      "purl": "pkg:npm/jsonparse@1.3.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/jsonparse/-/jsonparse-1.3.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/jsonparse@1.3.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/jsonparse/-/jsonparse-1.3.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "through",
      "version": "2.3.8",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0dd4c9ffaabc357960b1b724115d7e0e86a2e1f5"
        }
      ],
      "purl": "pkg:npm/through@2.3.8",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "http://registry.npmjs.org/through/-/through-2.3.8.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/through@2.3.8",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "http://registry.npmjs.org/through/-/through-2.3.8.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "jschardet",
      "version": "1.6.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "c58ba1bd0ec8f4f0c92060567aff719b4f9231279ddd90c1026bd58db151d5944b005faf957710bba71123db80963f35af38a4125455b5e7a1c15ec3b97d9999"
        }
      ],
      "purl": "pkg:npm/jschardet@1.6.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/jschardet/-/jschardet-1.6.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/jschardet@1.6.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/jschardet/-/jschardet-1.6.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "mocha",
      "version": "5.2.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "d8852028385cdc9ed4ba0f85c4c5eea88c98cc7ee02635c408a7bfc38dc81a04074d28f7227262fb2000ed3db82fd6d03112a25041f1117dfb1b926955418b71"
        }
      ],
      "purl": "pkg:npm/mocha@5.2.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/mocha/-/mocha-5.2.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/mocha@5.2.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/mocha/-/mocha-5.2.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      },
      "tags": [
        "test"
      ]
    },
    {
      "group": "",
      "name": "browser-stdout",
      "version": "1.3.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "aa1015235f80bf65fba9e94e7c0218c1738da2877a5e5644fdf5da052996fd3e52ccb0260a0ce2f9e89613b7d4bdb1da78d0501f5dd47ed8e95f1b1f2e432983"
        }
      ],
      "purl": "pkg:npm/browser-stdout@1.3.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/browser-stdout/-/browser-stdout-1.3.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/browser-stdout@1.3.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/browser-stdout/-/browser-stdout-1.3.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "commander",
      "version": "2.15.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "5657d3f45dd5d2ffa3af8cb13dce6083db3adbf7c8556b1dd81936883e37e6e9b536518c61d542abe3237179e162ada270d3a2cc7af590afb94c8e87d07cb46a"
        }
      ],
      "purl": "pkg:npm/commander@2.15.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/commander/-/commander-2.15.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/commander@2.15.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/commander/-/commander-2.15.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "debug",
      "version": "3.1.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "397f17a8feffd5af5caa4c58c36c97b2cd797f6e8d2960690d741dd3fb8afca3ea7508716cf6bdf78867ce3704d95a90a43b257f9e7bdb770a3d43864a6318de"
        }
      ],
      "purl": "pkg:npm/debug@3.1.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/debug/-/debug-3.1.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/debug@3.1.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/debug/-/debug-3.1.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "ms",
      "version": "2.0.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5608aeadfc00be6c2901df5f9861788de0d597c8"
        }
      ],
      "purl": "pkg:npm/ms@2.0.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/ms@2.0.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "diff",
      "version": "3.5.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "038eaab4581dfa0ee90d98a7a67c22449b716c2d61a607f4bb33f7886f3db1c1e4d00502ec0d531b17f93a288e52ffc931947c18eb7c84bf74d215746cecb9c4"
        }
      ],
      "purl": "pkg:npm/diff@3.5.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/diff/-/diff-3.5.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/diff@3.5.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/diff/-/diff-3.5.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "escape-string-regexp",
      "version": "1.0.5",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1b61c0562190a8dff6ae3bb2cf0200ca130b86d4"
        }
      ],
      "purl": "pkg:npm/escape-string-regexp@1.0.5",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/escape-string-regexp@1.0.5",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "glob",
      "version": "7.1.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "3094d4835923b8b790089f9c704e15a5aea42955e43d827698e090c94b8a2dc2d0b1dacc0a904f522f2a544ebe62e689928cde03d36eb13030de12ebf177b911"
        }
      ],
      "purl": "pkg:npm/glob@7.1.2",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/glob/-/glob-7.1.2.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/glob@7.1.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/glob/-/glob-7.1.2.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "fs.realpath",
      "version": "1.0.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1504ad2523158caa40db4a2787cb01411994ea4f"
        }
      ],
      "purl": "pkg:npm/fs.realpath@1.0.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/fs.realpath@1.0.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "inflight",
      "version": "1.0.6",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "49bd6331d7d02d0c09bc910a1075ba8165b56df9"
        }
      ],
      "purl": "pkg:npm/inflight@1.0.6",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/inflight@1.0.6",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "once",
      "version": "1.4.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "583b1aa775961d4b113ac17d9c50baef9dd76bd1"
        }
      ],
      "purl": "pkg:npm/once@1.4.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/once/-/once-1.4.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/once@1.4.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/once/-/once-1.4.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "wrappy",
      "version": "1.0.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b5243d8f3ec1aa35f1364605bc0d1036e30ab69f"
        }
      ],
      "purl": "pkg:npm/wrappy@1.0.2",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/wrappy@1.0.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "inherits",
      "version": "2.0.4",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "93fbc6697e3f6256b75b3c8c0af4d039761e207bea38ab67a8176ecd31e9ce9419cc0b2428c859d8af849c189233dcc64a820578ca572b16b8758799210a9ec1"
        }
      ],
      "purl": "pkg:npm/inherits@2.0.4",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/inherits@2.0.4",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "minimatch",
      "version": "3.0.4",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "c891d5404872a8f2d44e0b7d07cdcf5eee96debc7832fbc7bd252f4e8a20a70a060ce510fb20eb4741d1a2dfb23827423bbbb8857de959fb7a91604172a87450"
        }
      ],
      "purl": "pkg:npm/minimatch@3.0.4",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/minimatch@3.0.4",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "brace-expansion",
      "version": "1.1.11",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "882b8f1c3160ac75fb1f6bc423fe71a73d3bcd21c1d344e9ba0aa1998b5598c3bae75f260ae44ca0e60595d101974835f3bb9fa3375a1e058a71815beb5a8688"
        }
      ],
      "purl": "pkg:npm/brace-expansion@1.1.11",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/brace-expansion@1.1.11",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "balanced-match",
      "version": "1.0.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "de849e50ed13315ebb84dd4099b5ec2b8c9aa94eed8e21e56f144364ea47d0a5bdf82797e1b440697d009f1b74b71d8cae94695b041a3f02252121098585393f"
        }
      ],
      "purl": "pkg:npm/balanced-match@1.0.2",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/balanced-match@1.0.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "concat-map",
      "version": "0.0.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d8a96bd77fd68df7793a73036a3ba0d5405d477b"
        }
      ],
      "purl": "pkg:npm/concat-map@0.0.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/concat-map@0.0.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "path-is-absolute",
      "version": "1.0.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "174b9268735534ffbc7ace6bf53a5a9e1b5c5f5f"
        }
      ],
      "purl": "pkg:npm/path-is-absolute@1.0.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/path-is-absolute@1.0.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "growl",
      "version": "1.10.5",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "a81af83ae10b9213de9d6ea0a0a5578afe3b512ddc95bdff21bb9617d28d2848a3032f68787c54f488338ef2611e453385a8fbace503efe6065aa5232e9e6848"
        }
      ],
      "purl": "pkg:npm/growl@1.10.5",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/growl/-/growl-1.10.5.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/growl@1.10.5",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/growl/-/growl-1.10.5.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "he",
      "version": "1.1.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "93410fd21b009735151f8868c2f271f3427e23fd"
        }
      ],
      "purl": "pkg:npm/he@1.1.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/he/-/he-1.1.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/he@1.1.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/he/-/he-1.1.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "mkdirp",
      "version": "0.5.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "30057438eac6cf7f8c4767f38648d6697d75c903"
        }
      ],
      "purl": "pkg:npm/mkdirp@0.5.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/mkdirp@0.5.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "minimist",
      "version": "0.0.8",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "857fcabfc3397d2625b8228262e86aa7a011b05d"
        }
      ],
      "purl": "pkg:npm/minimist@0.0.8",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/minimist@0.0.8",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "supports-color",
      "version": "5.4.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "ce36978251799e75a9b2ae3bd234afe8ff43c0fbe02e4b9aa5899f0e6dc958e9b4be4353545dad23852b376afa8c7d6a33fb9cfd6b71618d6162803674e2a3e7"
        }
      ],
      "purl": "pkg:npm/supports-color@5.4.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/supports-color/-/supports-color-5.4.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/supports-color@5.4.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/supports-color/-/supports-color-5.4.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "has-flag",
      "version": "3.0.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b5d454dc2199ae225699f3467e5a07f3b955bafd"
        }
      ],
      "purl": "pkg:npm/has-flag@3.0.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/has-flag@3.0.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "pump",
      "version": "3.0.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "2f0672fa9dd216cd4fcad77f8d872de30a6fe3d1e2602a9df5195ce5955d93457ef18cefea34790659374d198f2f57edebd4f13f420c64627e58f154d81161c3"
        }
      ],
      "purl": "pkg:npm/pump@3.0.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/pump/-/pump-3.0.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/pump@3.0.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/pump/-/pump-3.0.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "end-of-stream",
      "version": "1.4.4",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "faec358a720754f428695b87cd1c97776d6270cf9c9ede02cc3e6b5be342d708ce5124ceb3e4deec53afec084deef4bdc7fa08ca12cfe4f4751fea614001eee5"
        }
      ],
      "purl": "pkg:npm/end-of-stream@1.4.4",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.4.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/end-of-stream@1.4.4",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.4.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "q",
      "version": "1.5.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7e32f75b41381291d04611f1bf14109ac00651d7"
        }
      ],
      "purl": "pkg:npm/q@1.5.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/q/-/q-1.5.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/q@1.5.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/q/-/q-1.5.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "should",
      "version": "13.2.3",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "8202deb0bb6edb1a7e67123ecac25398d8e1d94d13b02fab43fa5f103f5b5196780ca79f3f6ec3fbb6095554ef2ac9a32e9222f6301aee2b700c69030e6b7519"
        }
      ],
      "purl": "pkg:npm/should@13.2.3",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/should/-/should-13.2.3.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/should@13.2.3",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/should/-/should-13.2.3.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "should-equal",
      "version": "2.0.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "64fdfa4ccacaf5eb84b9641806283d5b9e563c2eeea37eeacc01266e31f3e207f2b97ac452017c714bd054efb0f9ddce31f3ef491409db69529bc310278dcb4c"
        }
      ],
      "purl": "pkg:npm/should-equal@2.0.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/should-equal/-/should-equal-2.0.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/should-equal@2.0.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/should-equal/-/should-equal-2.0.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "should-type",
      "version": "1.4.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0756d8ce846dfd09843a6947719dfa0d4cff5cf3"
        }
      ],
      "purl": "pkg:npm/should-type@1.4.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/should-type/-/should-type-1.4.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/should-type@1.4.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/should-type/-/should-type-1.4.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "should-format",
      "version": "3.0.3",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9bfc8f74fa39205c53d38c34d717303e277124f1"
        }
      ],
      "purl": "pkg:npm/should-format@3.0.3",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/should-format/-/should-format-3.0.3.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/should-format@3.0.3",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/should-format/-/should-format-3.0.3.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "should-type-adaptors",
      "version": "1.1.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "240e217682e737e91e6c4a7656cf1e05ef60eeecb4cdb468f9131c53412c372f91fa4d38f4a8be379b53e496a0b2dda0ec40236be7ae16ea171426bcbc89257c"
        }
      ],
      "purl": "pkg:npm/should-type-adaptors@1.1.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/should-type-adaptors/-/should-type-adaptors-1.1.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/should-type-adaptors@1.1.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/should-type-adaptors/-/should-type-adaptors-1.1.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "should-util",
      "version": "1.0.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c98cda374aa6b190df8ba87c9889c2b4db620063"
        }
      ],
      "purl": "pkg:npm/should-util@1.0.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/should-util/-/should-util-1.0.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/should-util@1.0.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/should-util/-/should-util-1.0.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "sinon",
      "version": "2.3.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b3433beea9514a904763bfebf48acd21d39e8a87"
        }
      ],
      "purl": "pkg:npm/sinon@2.3.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/sinon/-/sinon-2.3.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/sinon@2.3.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/sinon/-/sinon-2.3.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "formatio",
      "version": "1.2.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f3b2167d9068c4698a8d51f4f760a39a54d818eb"
        }
      ],
      "purl": "pkg:npm/formatio@1.2.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/formatio/-/formatio-1.2.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/formatio@1.2.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/formatio/-/formatio-1.2.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "samsam",
      "version": "1.3.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "d47c08603ffc5253ad152dd03b7c3b7b2f927520c51381d134b66865161541e7eb398de5d7b7a9b30226781d628e0245409a1d21a1dcc24a77aff9b20631556e"
        }
      ],
      "purl": "pkg:npm/samsam@1.3.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/samsam/-/samsam-1.3.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/samsam@1.3.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/samsam/-/samsam-1.3.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "lolex",
      "version": "1.6.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3a9a0283452a47d7439e72731b9e07d7386e49f6"
        }
      ],
      "purl": "pkg:npm/lolex@1.6.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/lolex/-/lolex-1.6.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/lolex@1.6.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/lolex/-/lolex-1.6.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "native-promise-only",
      "version": "0.8.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "20a318c30cb45f71fe7adfbf7b21c99c1472ef11"
        }
      ],
      "purl": "pkg:npm/native-promise-only@0.8.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/native-promise-only/-/native-promise-only-0.8.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/native-promise-only@0.8.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/native-promise-only/-/native-promise-only-0.8.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      },
      "tags": [
        "native"
      ]
    },
    {
      "group": "",
      "name": "path-to-regexp",
      "version": "1.8.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "9f8dc946195429402589b10984f7a2af59dc5080f5e909c48cda70ccd74edcb9b8cb0ac1a41679a0b0f423a6ebf5ebebd58f494eac11b4087b24ba0ecc041d54"
        }
      ],
      "purl": "pkg:npm/path-to-regexp@1.8.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-1.8.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/path-to-regexp@1.8.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-1.8.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "isarray",
      "version": "0.0.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8a18acfca9a8f4177e09abfc6038939b05d1eedf"
        }
      ],
      "purl": "pkg:npm/isarray@0.0.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/isarray/-/isarray-0.0.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/isarray@0.0.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/isarray/-/isarray-0.0.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "text-encoding",
      "version": "0.6.4",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e399a982257a276dae428bb92845cb71bdc26d19"
        }
      ],
      "purl": "pkg:npm/text-encoding@0.6.4",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/text-encoding/-/text-encoding-0.6.4.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/text-encoding@0.6.4",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/text-encoding/-/text-encoding-0.6.4.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "type-detect",
      "version": "4.0.8",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "d1faff9881f57653bec7b4e570ccbe6c80ea28fb30ffbd2d5727875bbf3b828423866a9a65ed74bb02ee8ee6caf6af4b83a162868d4a50a0d8cf467b93b839fe"
        }
      ],
      "purl": "pkg:npm/type-detect@4.0.8",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/type-detect/-/type-detect-4.0.8.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/type-detect@4.0.8",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/type-detect/-/type-detect-4.0.8.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "xml2js",
      "version": "0.4.19",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "7ac66725924e88947dc1628ccaebd2135cba0eae4b0ae25a9ea871b251f66f133a76e6a1359f8732908b8414066646d7eb145ff31d58d9e26582ddaadeaa38f5"
        }
      ],
      "purl": "pkg:npm/xml2js@0.4.19",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/xml2js/-/xml2js-0.4.19.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/xml2js@0.4.19",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/xml2js/-/xml2js-0.4.19.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      },
      "tags": [
        "xml"
      ]
    },
    {
      "group": "",
      "name": "xmlbuilder",
      "version": "9.0.7",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "132ee63d2ec5565c557e20f4c22df9aca686b10d"
        }
      ],
      "purl": "pkg:npm/xmlbuilder@9.0.7",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "http://registry.npmjs.org/xmlbuilder/-/xmlbuilder-9.0.7.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/xmlbuilder@9.0.7",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "http://registry.npmjs.org/xmlbuilder/-/xmlbuilder-9.0.7.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      },
      "tags": [
        "xml"
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/safer-buffer@2.1.2",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/iconv-lite@0.6.3",
      "dependsOn": [
        "pkg:npm/safer-buffer@2.1.2"
      ]
    },
    {
      "ref": "pkg:npm/sax@1.2.4",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/jsonparse@1.3.1",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/through@2.3.8",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/JSONStream@1.3.5",
      "dependsOn": [
        "pkg:npm/jsonparse@1.3.1",
        "pkg:npm/through@2.3.8"
      ]
    },
    {
      "ref": "pkg:npm/jschardet@1.6.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/browser-stdout@1.3.1",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/commander@2.15.1",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/ms@2.0.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/debug@3.1.0",
      "dependsOn": [
        "pkg:npm/ms@2.0.0"
      ]
    },
    {
      "ref": "pkg:npm/diff@3.5.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/escape-string-regexp@1.0.5",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/fs.realpath@1.0.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/wrappy@1.0.2",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/once@1.4.0",
      "dependsOn": [
        "pkg:npm/wrappy@1.0.2"
      ]
    },
    {
      "ref": "pkg:npm/inflight@1.0.6",
      "dependsOn": [
        "pkg:npm/once@1.4.0",
        "pkg:npm/wrappy@1.0.2"
      ]
    },
    {
      "ref": "pkg:npm/inherits@2.0.4",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/balanced-match@1.0.2",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/concat-map@0.0.1",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/brace-expansion@1.1.11",
      "dependsOn": [
        "pkg:npm/balanced-match@1.0.2",
        "pkg:npm/concat-map@0.0.1"
      ]
    },
    {
      "ref": "pkg:npm/minimatch@3.0.4",
      "dependsOn": [
        "pkg:npm/brace-expansion@1.1.11"
      ]
    },
    {
      "ref": "pkg:npm/path-is-absolute@1.0.1",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/glob@7.1.2",
      "dependsOn": [
        "pkg:npm/fs.realpath@1.0.0",
        "pkg:npm/inflight@1.0.6",
        "pkg:npm/inherits@2.0.4",
        "pkg:npm/minimatch@3.0.4",
        "pkg:npm/once@1.4.0",
        "pkg:npm/path-is-absolute@1.0.1"
      ]
    },
    {
      "ref": "pkg:npm/growl@1.10.5",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/he@1.1.1",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/minimist@0.0.8",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/mkdirp@0.5.1",
      "dependsOn": [
        "pkg:npm/minimist@0.0.8"
      ]
    },
    {
      "ref": "pkg:npm/has-flag@3.0.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/supports-color@5.4.0",
      "dependsOn": [
        "pkg:npm/has-flag@3.0.0"
      ]
    },
    {
      "ref": "pkg:npm/mocha@5.2.0",
      "dependsOn": [
        "pkg:npm/browser-stdout@1.3.1",
        "pkg:npm/commander@2.15.1",
        "pkg:npm/debug@3.1.0",
        "pkg:npm/diff@3.5.0",
        "pkg:npm/escape-string-regexp@1.0.5",
        "pkg:npm/glob@7.1.2",
        "pkg:npm/growl@1.10.5",
        "pkg:npm/he@1.1.1",
        "pkg:npm/minimatch@3.0.4",
        "pkg:npm/mkdirp@0.5.1",
        "pkg:npm/supports-color@5.4.0"
      ]
    },
    {
      "ref": "pkg:npm/end-of-stream@1.4.4",
      "dependsOn": [
        "pkg:npm/once@1.4.0"
      ]
    },
    {
      "ref": "pkg:npm/pump@3.0.0",
      "dependsOn": [
        "pkg:npm/end-of-stream@1.4.4",
        "pkg:npm/once@1.4.0"
      ]
    },
    {
      "ref": "pkg:npm/q@1.5.1",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/should-type@1.4.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/should-equal@2.0.0",
      "dependsOn": [
        "pkg:npm/should-type@1.4.0"
      ]
    },
    {
      "ref": "pkg:npm/should-util@1.0.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/should-type-adaptors@1.1.0",
      "dependsOn": [
        "pkg:npm/should-type@1.4.0",
        "pkg:npm/should-util@1.0.0"
      ]
    },
    {
      "ref": "pkg:npm/should-format@3.0.3",
      "dependsOn": [
        "pkg:npm/should-type-adaptors@1.1.0",
        "pkg:npm/should-type@1.4.0"
      ]
    },
    {
      "ref": "pkg:npm/should@13.2.3",
      "dependsOn": [
        "pkg:npm/should-equal@2.0.0",
        "pkg:npm/should-format@3.0.3",
        "pkg:npm/should-type-adaptors@1.1.0",
        "pkg:npm/should-type@1.4.0",
        "pkg:npm/should-util@1.0.0"
      ]
    },
    {
      "ref": "pkg:npm/samsam@1.3.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/formatio@1.2.0",
      "dependsOn": [
        "pkg:npm/samsam@1.3.0"
      ]
    },
    {
      "ref": "pkg:npm/lolex@1.6.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/native-promise-only@0.8.1",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/isarray@0.0.1",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/path-to-regexp@1.8.0",
      "dependsOn": [
        "pkg:npm/isarray@0.0.1"
      ]
    },
    {
      "ref": "pkg:npm/text-encoding@0.6.4",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/type-detect@4.0.8",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/sinon@2.3.0",
      "dependsOn": [
        "pkg:npm/diff@3.5.0",
        "pkg:npm/formatio@1.2.0",
        "pkg:npm/lolex@1.6.0",
        "pkg:npm/native-promise-only@0.8.1",
        "pkg:npm/path-to-regexp@1.8.0",
        "pkg:npm/samsam@1.3.0",
        "pkg:npm/text-encoding@0.6.4",
        "pkg:npm/type-detect@4.0.8"
      ]
    },
    {
      "ref": "pkg:npm/xmlbuilder@9.0.7",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/xml2js@0.4.19",
      "dependsOn": [
        "pkg:npm/sax@1.2.4",
        "pkg:npm/xmlbuilder@9.0.7"
      ]
    },
    {
      "ref": "pkg:npm/needle@3.3.1",
      "dependsOn": [
        "pkg:npm/JSONStream@1.3.5",
        "pkg:npm/iconv-lite@0.6.3",
        "pkg:npm/jschardet@1.6.0",
        "pkg:npm/mocha@5.2.0",
        "pkg:npm/pump@3.0.0",
        "pkg:npm/q@1.5.1",
        "pkg:npm/sax@1.2.4",
        "pkg:npm/should@13.2.3",
        "pkg:npm/sinon@2.3.0",
        "pkg:npm/xml2js@0.4.19"
      ]
    }
  ],
  "annotations": [
    {
      "bom-ref": "metadata-annotations",
      "subjects": [
        "pkg:npm/needle@3.3.1"
      ],
      "annotator": {
        "component": {
          "group": "@cyclonedx",
          "name": "cdxgen",
          "version": "12.8.4",
          "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.4",
          "type": "application",
          "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.4",
          "publisher": "OWASP Foundation",
          "authors": [
            {
              "name": "OWASP Foundation"
            }
          ]
        }
      },
      "timestamp": "2026-09-09T18:22:20Z",
      "text": "This Software Bill-of-Materials (SBOM) document was created on Wednesday, September 9, 2026 with cdxgen. The data was captured during the pre-build lifecycle phase without building the application. The document describes an application named 'needle' with version '3.3.1'."
    }
  ]
}