{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:1e293482-909a-5b69-a594-293ad0935118",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/npm@5.10.0-tuxcare.1",
      "type": "library",
      "name": "npm",
      "version": "5.10.0-tuxcare.1",
      "purl": "pkg:npm/npm@5.10.0-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:c1563087-4688-5eb9-8c20-d9184c7312bc",
      "id": "CVE-2019-16775",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-16775 does not affect version 5.10.0-tuxcare.1 of npm. already_fixed \u2014 CVE-2019-16775 has been fixed in npm 5.10.0-tuxcare.1 via TuxCare backport commit d24215955 which upgraded bin-links from 1.1.0 to 1.1.8. The fixed bin-links version includes npm-normalize-package-bin for path sanitization and validation checks to prevent symlinks outside package directories."
      },
      "affects": [
        {
          "ref": "pkg:npm/npm@5.10.0-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:97c237b5-2a2c-5df8-9867-84f3f3e7e42c",
      "id": "CVE-2019-16776",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-16776 does not affect version 5.10.0-tuxcare.1 of npm. already_fixed \u2014 CVE-2019-16776 has been fixed by TuxCare in commit 38416fab7. The fix updates package.json to require bin-links ^1.1.8, which includes the security patches (npm-normalize-package-bin for path sanitization and indexOf validation for path containment). While the bin-links module code is not physically present in the git repository (as dependencies are not committed in Node.js projects), the packa..."
      },
      "affects": [
        {
          "ref": "pkg:npm/npm@5.10.0-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cfe20a97-9f75-5f40-9a85-6c51e10b111e",
      "id": "CVE-2019-16777",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-16777 does not affect version 5.10.0-tuxcare.1 of npm. already_fixed \u2014 CVE-2019-16777 has been fixed in this repository. TuxCare applied the upstream fix in commit d24215955 (JSELS-3218) by upgrading bin-links to 1.1.8 and gentle-fs to 2.3.1, matching the upstream fix versions (1.1.6 and 2.3.0 respectively). The fix prevents arbitrary file overwrite of global binaries by adding clobberLinkGently logic that refuses to overwrite existing global bin/man links unless ..."
      },
      "affects": [
        {
          "ref": "pkg:npm/npm@5.10.0-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1f75dc71-5d56-54ff-b914-ce2d78f9bc67",
      "id": "CVE-2020-15095",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-15095 does not affect version 5.10.0-tuxcare.1 of npm. already_fixed \u2014 CVE-2020-15095 has been fixed in this repository. TuxCare backported the upstream npm 6.14.6 fix to npm 5.10.0 via commit 39a38e19d (JSELS-3223). The fix introduces lib/utils/replace-info.js which sanitizes URLs by replacing password fields with '***' before logging. This defense is correctly applied in bin/npm-cli.js, lib/utils/error-handler.js, lib/utils/error-message.js, and lib/fetch-packag..."
      },
      "affects": [
        {
          "ref": "pkg:npm/npm@5.10.0-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2810ff50-e231-59ac-b9d2-f9236c09d7b0",
      "id": "CVE-2022-25858",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-25858 is fixed in version 5.10.0-tuxcare.1 of npm."
      },
      "affects": [
        {
          "ref": "pkg:npm/npm@5.10.0-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9167ec51-bac5-5e26-8f33-2a232c55386e",
      "id": "CVE-2026-0775",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2026-0775 is a false positive for npm 5.10.0-tuxcare.1."
      },
      "affects": [
        {
          "ref": "pkg:npm/npm@5.10.0-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/npm@5.10.0-tuxcare.1"
    }
  ]
}