npm package-lock with Bomdesk
This opens a small package-lock.json. Press Scan to see licences and advisories, then download CycloneDX or SPDX. Paste your own file over it to use it for real.
- Paste your package-lock.json or drop the file on the box.
- Press Scan to add licences and known advisories (only names and versions are sent).
- Download CycloneDX 1.5 or SPDX 2.3 JSON.
- Attach the file to the questionnaire, release or audit that asked for it.
What to know
package-lock.json already contains what an SBOM needs: every installed package, direct and transitive, at its exact version. Lockfile versions 2 and 3 also record each package's licence and whether it is dev-only, which is why the licence column fills in even before a lookup. Version 1 lockfiles do not, so Bomdesk asks deps.dev for them.
npm can also write an SBOM itself with the npm sbom command. Bomdesk is useful when you do not have the project checked out or installed, when you also want the licence classes and advisories next to the list, or when the same person needs to handle a Python or Go project too. On a test lockfile with 246 packages, the component list matched the one npm sbom produced exactly.
Dev-only packages are marked with a dev tag, and the policy and report tools can ignore them. Packages linked from a local workspace are skipped because they are your own code, and the page tells you when that happened.
Updated · Cosmovex
Questions
Does the SBOM include transitive dependencies?
Yes. Every package in the lockfile is listed, whichever level pulled it in. Packages you declared yourself are marked as direct.
Which lockfile versions work?
Versions 1, 2 and 3. Version 1 has no licence data, so licences come from the lookup.
Which SBOM format should I send?
Send the one the requester names. If they do not say, CycloneDX is the more common ask for application dependencies and SPDX for licence compliance.
Is the lockfile enough, or do I need node_modules?
The lockfile is enough. It records the resolved version of every package, so nothing needs to be installed. Packages that were installed but are missing from the lockfile would not appear.
The free plan covers everything on this page. Bomdesk Pro ($19, paid once) is described on the Bomdesk page.
