{
  "bomFormat": "CycloneDX",
  "specVersion": "1.7",
  "serialNumber": "urn:uuid:a73f3818-4892-4b2f-852d-a15da18c51e9",
  "version": 1,
  "metadata": {
    "timestamp": "2026-09-11T17:34:50Z",
    "tools": {
      "components": [
        {
          "group": "@cyclonedx",
          "name": "cdxgen",
          "version": "12.8.4",
          "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.4",
          "type": "application",
          "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.4",
          "publisher": "OWASP Foundation",
          "authors": [
            {
              "name": "OWASP Foundation"
            }
          ]
        }
      ]
    },
    "authors": [
      {
        "name": "OWASP Foundation"
      }
    ],
    "lifecycles": [
      {
        "phase": "pre-build"
      }
    ],
    "component": {
      "name": "toml",
      "group": "",
      "version": "4.3.0",
      "description": "TOML parser for Node.js (TOML v1.1.0 compliant)",
      "purl": "pkg:npm/toml@4.3.0",
      "bom-ref": "pkg:npm/toml@4.3.0",
      "author": "Michelle Tilley <michelle@michelletilley.net>",
      "properties": [
        {
          "name": "cdx:npm:scripts",
          "value": "build, test, test:spec, test:spec:fresh, test:spec:failures, test:all, prepublishOnly"
        },
        {
          "name": "cdx:npm:buildScripts",
          "value": "build"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "type": "application",
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "externalReferences": [
        {
          "type": "vcs",
          "url": "git://github.com/BinaryMuse/toml-node.git"
        }
      ]
    },
    "properties": [
      {
        "name": "cdx:bom:componentTypes",
        "value": "npm"
      },
      {
        "name": "cdx:bom:componentNamespaces",
        "value": "@js-temporal\\n@peggyjs"
      },
      {
        "name": "cdx:bom:componentSrcFiles",
        "value": "package-lock.json"
      }
    ]
  },
  "components": [
    {
      "group": "@js-temporal",
      "name": "polyfill",
      "version": "0.5.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "865a0fe7ccd1542452a600f19aa09624d962cc095480916a1b6ca9abbf430afcaff6d1e345830339c3c58f37e5fc0d7f6310ef442673f30bd9be66a94272b015"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://opensource.org/licenses/ISC",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/%40js-temporal/polyfill@0.5.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/@js-temporal/polyfill/-/polyfill-0.5.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@js-temporal/polyfill@0.5.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/@js-temporal/polyfill/-/polyfill-0.5.1.tgz"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "jsbi",
      "version": "4.3.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "f5fa8c4906e12729127a28b4e67c4a9789ba12a9f63faace958892f82e43aff1cf214ffbc99c6ee6acdbb38d2d81a14e462c360267749a2ae3c5ab5760c9087b"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://opensource.org/licenses/Apache-2.0",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/jsbi@4.3.2",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/jsbi/-/jsbi-4.3.2.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/jsbi@4.3.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/jsbi/-/jsbi-4.3.2.tgz"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "peggy",
      "version": "5.1.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "204a39698459da45c7e106f2d3a723b4bd75e0f667c0ba13880e35bd49a0daf3d9800367f9cf3b9b9054bab86e0ebe7f72eef9f1996982c01f055c7e8613b9fb"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/peggy@5.1.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/peggy/-/peggy-5.1.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/peggy@5.1.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/peggy/-/peggy-5.1.0.tgz"
        },
        {
          "name": "cdx:npm:binPaths",
          "value": "/app/node_modules/.bin/peggy"
        },
        {
          "name": "cdx:npm:bin",
          "value": "peggy"
        },
        {
          "name": "cdx:npm:has_binary",
          "value": "true"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "@peggyjs",
      "name": "from-mem",
      "version": "3.1.3",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "2cb960b5f5c869e617a0e628bce234b292ccf195daaa402599c451acbcc72732ccaa453a4b0d11e0a3280a81f1d4f8da3fcd79a52081952f8137a683f2dd4982"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/%40peggyjs/from-mem@3.1.3",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/@peggyjs/from-mem/-/from-mem-3.1.3.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@peggyjs/from-mem@3.1.3",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/@peggyjs/from-mem/-/from-mem-3.1.3.tgz"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "semver",
      "version": "7.7.4",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "bc5282d8812d427561a53efc875629f30cf0adff0233e33328c1c62597c1b738593727111675ec1e4e84e53c4892432c80d4bb99d5f700607bc7640cd9d8b894"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://opensource.org/licenses/ISC",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/semver@7.7.4",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/semver@7.7.4",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz"
        },
        {
          "name": "cdx:npm:binPaths",
          "value": "/app/node_modules/.bin/semver"
        },
        {
          "name": "cdx:npm:bin",
          "value": "semver"
        },
        {
          "name": "cdx:npm:has_binary",
          "value": "true"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "commander",
      "version": "14.0.3",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "1fecb4268fd3d5167da8f3f8121d6991c41c2d1825ada25a48ba323ad1f1bba01aa648d6542cb64a2b75410e31dc39e0f2a0e54ac6447adee0e4fab4e8cbd383"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/commander@14.0.3",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/commander/-/commander-14.0.3.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/commander@14.0.3",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/commander/-/commander-14.0.3.tgz"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "source-map-generator",
      "version": "2.0.6",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "2256acb03b3555ef2757abb24195c5f6476426954a9ccb5ed896505eed77334039cf073ebeeebe2cd1df9b1b0704c0eda19136d511e2288d3fc6fa5e71944236"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "BSD-3-Clause",
            "url": "https://opensource.org/licenses/BSD-3-Clause",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/source-map-generator@2.0.6",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/source-map-generator/-/source-map-generator-2.0.6.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/source-map-generator@2.0.6",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/source-map-generator/-/source-map-generator-2.0.6.tgz"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/jsbi@4.3.2",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/@js-temporal/polyfill@0.5.1",
      "dependsOn": [
        "pkg:npm/jsbi@4.3.2"
      ]
    },
    {
      "ref": "pkg:npm/semver@7.7.4",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/@peggyjs/from-mem@3.1.3",
      "dependsOn": [
        "pkg:npm/semver@7.7.4"
      ]
    },
    {
      "ref": "pkg:npm/commander@14.0.3",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/source-map-generator@2.0.6",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/peggy@5.1.0",
      "dependsOn": [
        "pkg:npm/@peggyjs/from-mem@3.1.3",
        "pkg:npm/commander@14.0.3",
        "pkg:npm/source-map-generator@2.0.6"
      ]
    },
    {
      "ref": "pkg:npm/toml@4.3.0",
      "dependsOn": [
        "pkg:npm/@js-temporal/polyfill@0.5.1",
        "pkg:npm/peggy@5.1.0"
      ]
    }
  ],
  "annotations": [
    {
      "bom-ref": "metadata-annotations",
      "subjects": [
        "pkg:npm/toml@4.3.0"
      ],
      "annotator": {
        "component": {
          "group": "@cyclonedx",
          "name": "cdxgen",
          "version": "12.8.4",
          "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.4",
          "type": "application",
          "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.4",
          "publisher": "OWASP Foundation",
          "authors": [
            {
              "name": "OWASP Foundation"
            }
          ]
        }
      },
      "timestamp": "2026-09-11T17:34:50Z",
      "text": "This Software Bill-of-Materials (SBOM) document was created on Friday, September 11, 2026 with cdxgen. The data was captured during the pre-build lifecycle phase without building the application. The document describes an application named 'toml' with version '4.3.0'. The package type in this SBOM is npm with 2 purl namespaces described under components. The components were identified from the source files: package-lock.json."
    }
  ]
}