{
  "bomFormat": "CycloneDX",
  "specVersion": "1.7",
  "serialNumber": "urn:uuid:14957480-637a-488c-abbb-42b12cf51af6",
  "version": 1,
  "metadata": {
    "timestamp": "2026-09-14T04:16:50Z",
    "tools": {
      "components": [
        {
          "group": "@cyclonedx",
          "name": "cdxgen",
          "version": "12.8.4",
          "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.4",
          "type": "application",
          "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.4",
          "publisher": "OWASP Foundation",
          "authors": [
            {
              "name": "OWASP Foundation"
            }
          ]
        }
      ]
    },
    "authors": [
      {
        "name": "OWASP Foundation"
      }
    ],
    "lifecycles": [
      {
        "phase": "pre-build"
      }
    ],
    "component": {
      "name": "create-astro",
      "group": "",
      "version": "0.0.2",
      "purl": "pkg:npm/create-astro@0.0.2",
      "bom-ref": "pkg:npm/create-astro@0.0.2",
      "properties": [
        {
          "name": "cdx:npm:bin",
          "value": "create-astro"
        },
        {
          "name": "cdx:npm:has_binary",
          "value": "true"
        }
      ],
      "type": "application"
    },
    "properties": [
      {
        "name": "cdx:bom:componentTypes",
        "value": "npm"
      },
      {
        "name": "cdx:bom:componentSrcFiles",
        "value": "package-lock.json"
      }
    ]
  },
  "components": [
    {
      "group": "",
      "name": "decompress",
      "version": "4.2.1",
      "scope": "required",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "7b8f2473622353ed99c3c7136fa55970943796055b4b8bae0754df0876e26483ff85a3579be495ca1bbef3b8edb39ff744ea5df36192542a0db3fcfc97864e69"
        }
      ],
      "purl": "pkg:npm/decompress@4.2.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/decompress/-/decompress-4.2.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/decompress@4.2.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/decompress/-/decompress-4.2.1.tgz"
        },
        {
          "name": "ImportedModules",
          "value": "decompress"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ],
        "occurrences": [
          {
            "location": "index.js",
            "line": 3
          },
          {
            "location": "index.js",
            "line": 22
          }
        ]
      }
    },
    {
      "group": "",
      "name": "decompress-tar",
      "version": "4.1.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "25d24c682ac6a41e5f112572c70a42c7825d8f601a80b9afdf2e7c432e0613a1cc5635b3d45795424d42b782b27bb3dfb5c74ea3fed4ed42b3601260aa719e51"
        }
      ],
      "purl": "pkg:npm/decompress-tar@4.1.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/decompress-tar/-/decompress-tar-4.1.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/decompress-tar@4.1.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/decompress-tar/-/decompress-tar-4.1.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "file-type",
      "version": "5.2.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2ddbea7c73ffe36368dfae49dc338c058c2b8ad6"
        }
      ],
      "purl": "pkg:npm/file-type@5.2.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/file-type/-/file-type-5.2.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/file-type@5.2.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/file-type/-/file-type-5.2.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "is-stream",
      "version": "1.1.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "12d4a3dd4e68e0b79ceb8dbc84173ae80d91ca44"
        }
      ],
      "purl": "pkg:npm/is-stream@1.1.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/is-stream/-/is-stream-1.1.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/is-stream@1.1.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/is-stream/-/is-stream-1.1.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "tar-stream",
      "version": "1.6.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "af34b485e88d7fc5e7eff9a975255548c016028cbd6df6f558e4d80bbf19d1440a78a6bf0964bc14eab494a18d6bc0d62809fd8318c2bcc2d87393c65d894ad8"
        }
      ],
      "purl": "pkg:npm/tar-stream@1.6.2",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/tar-stream/-/tar-stream-1.6.2.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/tar-stream@1.6.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/tar-stream/-/tar-stream-1.6.2.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "bl",
      "version": "1.2.3",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "a6f70da5ad1453af544f7e35acee80632e05540224507b995d12166eafb31e7b15711cc30e3200846bae6288b477ffdcc08c2db78a64a4ac9c5847e3755fafc3"
        }
      ],
      "purl": "pkg:npm/bl@1.2.3",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/bl/-/bl-1.2.3.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/bl@1.2.3",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/bl/-/bl-1.2.3.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "readable-stream",
      "version": "2.3.7",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "11b868f0ae2321b1c0c67bb18bba38d8ead9805fd94cd72c663ea744ac949a484b16af021c8b69fdfcba85066e6663ff9f7c99f550546e9e33cff997f219983f"
        }
      ],
      "purl": "pkg:npm/readable-stream@2.3.7",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.7.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/readable-stream@2.3.7",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.7.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "core-util-is",
      "version": "1.0.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b5fd54220aa2bc5ab57aab7140c940754503c1a7"
        }
      ],
      "purl": "pkg:npm/core-util-is@1.0.2",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.2.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/core-util-is@1.0.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.2.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "inherits",
      "version": "2.0.4",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "93fbc6697e3f6256b75b3c8c0af4d039761e207bea38ab67a8176ecd31e9ce9419cc0b2428c859d8af849c189233dcc64a820578ca572b16b8758799210a9ec1"
        }
      ],
      "purl": "pkg:npm/inherits@2.0.4",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/inherits@2.0.4",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "isarray",
      "version": "1.0.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bb935d48582cba168c06834957a54a3e07124f11"
        }
      ],
      "purl": "pkg:npm/isarray@1.0.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/isarray@1.0.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "process-nextick-args",
      "version": "2.0.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "de8b943a9421b60adb39ad7b27bfaec4e4e92136166863fbfc0868477f80fbfd5ef6c92bcde9468bf757cc4632bdbc6e6c417a5a7db2a6c7132a22891459f56a"
        }
      ],
      "purl": "pkg:npm/process-nextick-args@2.0.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/process-nextick-args@2.0.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "safe-buffer",
      "version": "5.1.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "19dd94641243917958ec66c9c5fb04f3f9ef2a45045351b7f1cd6c88de903fa6bd3d3f4c98707c1a7a6c71298c252a05f0b388aedf2e77fc0fb688f2b381bafa"
        }
      ],
      "purl": "pkg:npm/safe-buffer@5.1.2",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/safe-buffer@5.1.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "string_decoder",
      "version": "1.1.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "9ff4a19ef0e2e851db6d57ef8aba3e5a88e2173bfeb3c30f30705ccd578f7d4a4324bc282d3d21b759786300426e2f29240bde104767907c8fc933ff9b345fc2"
        }
      ],
      "purl": "pkg:npm/string_decoder@1.1.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/string_decoder@1.1.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "util-deprecate",
      "version": "1.0.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "450d4dc9fa70de732762fbd2d4a28981419a0ccf"
        }
      ],
      "purl": "pkg:npm/util-deprecate@1.0.2",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/util-deprecate@1.0.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "safe-buffer",
      "version": "5.2.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "ae9dd2a34eca71d9a629b1af81a37141226bedb1954959394bd12ad45fa9a5b468ef4f9879a0f1930e4377c34f37e183e9b8e7626d95b8fb825e6a6e62f9825d"
        }
      ],
      "purl": "pkg:npm/safe-buffer@5.2.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/safe-buffer@5.2.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "buffer-alloc",
      "version": "1.2.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "085b074208ed5b550285d5e06f2246b679be3bfb8b41e65db5b0e8f267d48185c21d2335c20ad5c579ba6d2cab52e12b11bfb8b185460b3012051a2def3caba3"
        }
      ],
      "purl": "pkg:npm/buffer-alloc@1.2.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/buffer-alloc/-/buffer-alloc-1.2.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/buffer-alloc@1.2.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/buffer-alloc/-/buffer-alloc-1.2.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "buffer-alloc-unsafe",
      "version": "1.1.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "4c433688c20441d276ca33c9a1222c95d9e5795680935a16dc305553293238bb04b0598473d927f921453f3fa0979e0a40dc650e7030097a2c392f4e931db102"
        }
      ],
      "purl": "pkg:npm/buffer-alloc-unsafe@1.1.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/buffer-alloc-unsafe/-/buffer-alloc-unsafe-1.1.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/buffer-alloc-unsafe@1.1.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/buffer-alloc-unsafe/-/buffer-alloc-unsafe-1.1.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "buffer-fill",
      "version": "1.0.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f8f78b76789888ef39f205cd637f68e702122b2c"
        }
      ],
      "purl": "pkg:npm/buffer-fill@1.0.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/buffer-fill/-/buffer-fill-1.0.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/buffer-fill@1.0.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/buffer-fill/-/buffer-fill-1.0.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "end-of-stream",
      "version": "1.4.4",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "faec358a720754f428695b87cd1c97776d6270cf9c9ede02cc3e6b5be342d708ce5124ceb3e4deec53afec084deef4bdc7fa08ca12cfe4f4751fea614001eee5"
        }
      ],
      "purl": "pkg:npm/end-of-stream@1.4.4",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.4.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/end-of-stream@1.4.4",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.4.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "once",
      "version": "1.4.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "583b1aa775961d4b113ac17d9c50baef9dd76bd1"
        }
      ],
      "purl": "pkg:npm/once@1.4.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/once/-/once-1.4.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/once@1.4.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/once/-/once-1.4.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "wrappy",
      "version": "1.0.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b5243d8f3ec1aa35f1364605bc0d1036e30ab69f"
        }
      ],
      "purl": "pkg:npm/wrappy@1.0.2",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/wrappy@1.0.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "fs-constants",
      "version": "1.0.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "cba380c284887fb1728cc22ff78bbe6f9add85e6448f347adc64f26499b9aa1e018bed988302c2708fdf3c56642f93d28b13ade9934a9bec3e1dfa7f05c8b0a3"
        }
      ],
      "purl": "pkg:npm/fs-constants@1.0.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/fs-constants@1.0.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "to-buffer",
      "version": "1.1.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "971f41e62bfb9acb85604dddcad4fe284e6d6a9fab358c3e2b88d591bf51fdab006fea5b052335ee3b6e9c7a658417ba45125d671dcf9f6269876e0edf698e56"
        }
      ],
      "purl": "pkg:npm/to-buffer@1.1.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/to-buffer/-/to-buffer-1.1.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/to-buffer@1.1.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/to-buffer/-/to-buffer-1.1.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "xtend",
      "version": "4.0.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "2ca614d620172575200179fd5118e2bbe3168725171ecbdfa7b99cb989bd75250a2b4fc28edad4c050310fcdbf98259bb4bb068c521a774c08b28778ceb4c011"
        }
      ],
      "purl": "pkg:npm/xtend@4.0.2",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/xtend/-/xtend-4.0.2.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/xtend@4.0.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/xtend/-/xtend-4.0.2.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "decompress-tarbz2",
      "version": "4.1.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "b3cf312f37f5afcd480972c055057368de99997e00e94e33da731b3b0a1bc642e82087e354c060ed37a0b9351790a7979e2efde41eb2e6b9ef0f0eebc6102af4"
        }
      ],
      "purl": "pkg:npm/decompress-tarbz2@4.1.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/decompress-tarbz2/-/decompress-tarbz2-4.1.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/decompress-tarbz2@4.1.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/decompress-tarbz2/-/decompress-tarbz2-4.1.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "file-type",
      "version": "6.2.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "60f71304357ed939b456a8f26d5777d8c1dd944180b6ec52dd5018b2e985a240d2306f91393e706b01a59c70e8cfb6df31c303b7d871b97bd7c28294c767e43a"
        }
      ],
      "purl": "pkg:npm/file-type@6.2.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/file-type/-/file-type-6.2.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/file-type@6.2.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/file-type/-/file-type-6.2.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "seek-bzip",
      "version": "1.0.6",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "7b542d3f760be6d5b0c3cb8a68e090d7c531213da568d0571e357f4b65980a22b8b9d8aff25906f3d2912280a351a827026081bab8c5e331155f607205b9c28d"
        }
      ],
      "purl": "pkg:npm/seek-bzip@1.0.6",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/seek-bzip/-/seek-bzip-1.0.6.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/seek-bzip@1.0.6",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/seek-bzip/-/seek-bzip-1.0.6.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "commander",
      "version": "2.20.3",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "1a956498cf2f176bd05248f62ef6660f7e49c5e24e2c2c09f5c524ba0ca4da7ba16efdfe989be92d862dfb4f9448cc44fa88fe7b2fe52449e1670ef9c7f38c71"
        }
      ],
      "purl": "pkg:npm/commander@2.20.3",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/commander@2.20.3",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "unbzip2-stream",
      "version": "1.4.3",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "9a5131196e30ef579b0c9be21f5ea540bb594b7d952aab127e4f341827d49704ffe3f84d445b28b1cac5fdcfbef718a790ccc408bd6e2fd0c3c17a855a4aee3e"
        }
      ],
      "purl": "pkg:npm/unbzip2-stream@1.4.3",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/unbzip2-stream/-/unbzip2-stream-1.4.3.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/unbzip2-stream@1.4.3",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/unbzip2-stream/-/unbzip2-stream-1.4.3.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "buffer",
      "version": "5.7.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "10773220f050e0148696f8c1d7a9392a0009dbb088b0763fd8906609145ea38f32f6b43731a533597dca56505ae14eccc97d361dd563d0aec2dd6681de3bbb15"
        }
      ],
      "purl": "pkg:npm/buffer@5.7.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/buffer@5.7.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "base64-js",
      "version": "1.5.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "00aa5a6251e7f2de1255b3870b2f9be7e28a82f478bebb03f2f6efadb890269b3b7ca0d3923903af2ea38b4ad42630b49336cd78f2f0cf1abc8b2a68e35a9e58"
        }
      ],
      "purl": "pkg:npm/base64-js@1.5.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/base64-js@1.5.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "ieee754",
      "version": "1.2.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "75ccaa843bd7d42e3a95765c56a0a92be16d31141574830debf0dfe63b36ce8b94b2a1bb23ab05c62b480beeca60adbd29d5ce2c776ef732f8b059e85509ea68"
        }
      ],
      "purl": "pkg:npm/ieee754@1.2.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/ieee754@1.2.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "through",
      "version": "2.3.8",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0dd4c9ffaabc357960b1b724115d7e0e86a2e1f5"
        }
      ],
      "purl": "pkg:npm/through@2.3.8",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/through/-/through-2.3.8.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/through@2.3.8",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/through/-/through-2.3.8.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "decompress-targz",
      "version": "4.1.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "e33f356677ebe9c8569d10cd7c536a2f03ef9b875bdd6b9992a57e5205d0cd29e01b708429d064c398ebbf76b18e32fdea09728a22a3b31246dd7e96059c17df"
        }
      ],
      "purl": "pkg:npm/decompress-targz@4.1.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/decompress-targz/-/decompress-targz-4.1.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/decompress-targz@4.1.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/decompress-targz/-/decompress-targz-4.1.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "decompress-unzip",
      "version": "4.0.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "deaaccdfd14aeaf85578f733ae8210f9b4848f69"
        }
      ],
      "purl": "pkg:npm/decompress-unzip@4.0.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/decompress-unzip/-/decompress-unzip-4.0.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/decompress-unzip@4.0.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/decompress-unzip/-/decompress-unzip-4.0.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "file-type",
      "version": "3.9.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "257a078384d1db8087bc449d107d52a52672b9e9"
        }
      ],
      "purl": "pkg:npm/file-type@3.9.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/file-type/-/file-type-3.9.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/file-type@3.9.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/file-type/-/file-type-3.9.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "get-stream",
      "version": "2.3.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5f38f93f346009666ee0150a054167f91bdd95de"
        }
      ],
      "purl": "pkg:npm/get-stream@2.3.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/get-stream/-/get-stream-2.3.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/get-stream@2.3.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/get-stream/-/get-stream-2.3.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "object-assign",
      "version": "4.1.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2109adc7965887cfc05cbbd442cac8bfbb360863"
        }
      ],
      "purl": "pkg:npm/object-assign@4.1.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/object-assign@4.1.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "pinkie-promise",
      "version": "2.0.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2135d6dfa7a358c069ac9b178776288228450ffa"
        }
      ],
      "purl": "pkg:npm/pinkie-promise@2.0.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/pinkie-promise/-/pinkie-promise-2.0.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/pinkie-promise@2.0.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/pinkie-promise/-/pinkie-promise-2.0.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "pinkie",
      "version": "2.0.4",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "72556b80cfa0d48a974e80e77248e80ed4f7f870"
        }
      ],
      "purl": "pkg:npm/pinkie@2.0.4",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/pinkie/-/pinkie-2.0.4.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/pinkie@2.0.4",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/pinkie/-/pinkie-2.0.4.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "pify",
      "version": "2.3.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ed141a6ac043a849ea588498e7dca8b15330e90c"
        }
      ],
      "purl": "pkg:npm/pify@2.3.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/pify/-/pify-2.3.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/pify@2.3.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/pify/-/pify-2.3.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "yauzl",
      "version": "2.10.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c7eb17c93e112cb1086fa6d8e51fb0667b79a5f9"
        }
      ],
      "purl": "pkg:npm/yauzl@2.10.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/yauzl/-/yauzl-2.10.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/yauzl@2.10.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/yauzl/-/yauzl-2.10.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "buffer-crc32",
      "version": "0.2.13",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0d333e3f00eac50aa1454abd30ef8c2a5d9a7242"
        }
      ],
      "purl": "pkg:npm/buffer-crc32@0.2.13",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-0.2.13.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/buffer-crc32@0.2.13",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-0.2.13.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "fd-slicer",
      "version": "1.1.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "25c7c89cb1f9077f8891bbe61d8f390eae256f1e"
        }
      ],
      "purl": "pkg:npm/fd-slicer@1.1.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/fd-slicer/-/fd-slicer-1.1.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/fd-slicer@1.1.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/fd-slicer/-/fd-slicer-1.1.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "pend",
      "version": "1.2.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7a57eb550a6783f9115331fcf4663d5c8e007a50"
        }
      ],
      "purl": "pkg:npm/pend@1.2.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/pend/-/pend-1.2.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/pend@1.2.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/pend/-/pend-1.2.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "graceful-fs",
      "version": "4.2.6",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "9d39c9e76f296eac586a78690d8b22e1177c30079a040ebbf91675d023359b76d30151440dc77902e0386ba5b9624199d623571f3673f13e9304a2de06e36b89"
        }
      ],
      "purl": "pkg:npm/graceful-fs@4.2.6",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.6.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/graceful-fs@4.2.6",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.6.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "make-dir",
      "version": "1.3.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "db0df547b489b6278926742d19ced154bd92b4cdaf19855fa943af503c47e9b0ba6894f13f14c5d069c8802caeeed8e872489458061045bc5aeef2a7df8b39b1"
        }
      ],
      "purl": "pkg:npm/make-dir@1.3.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/make-dir/-/make-dir-1.3.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/make-dir@1.3.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/make-dir/-/make-dir-1.3.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "pify",
      "version": "3.0.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e5a4acd2c101fdf3d9a4d07f0dbc4db49dd28176"
        }
      ],
      "purl": "pkg:npm/pify@3.0.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/pify/-/pify-3.0.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/pify@3.0.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/pify/-/pify-3.0.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "strip-dirs",
      "version": "2.1.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "24e0b139e28b9b60804bbdf2fd4e197993d3904fa03550b32adec4a31f3821e8f52d3ff6a53598a59289bb1c10a6f5f52e265bd71a24351ed12dfb8101aed3de"
        }
      ],
      "purl": "pkg:npm/strip-dirs@2.1.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/strip-dirs/-/strip-dirs-2.1.0.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/strip-dirs@2.1.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/strip-dirs/-/strip-dirs-2.1.0.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    },
    {
      "group": "",
      "name": "is-natural-number",
      "version": "4.0.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ab9d76e1db4ced51e35de0c72ebecf09f734cde8"
        }
      ],
      "purl": "pkg:npm/is-natural-number@4.0.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/is-natural-number/-/is-natural-number-4.0.1.tgz"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/is-natural-number@4.0.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/is-natural-number/-/is-natural-number-4.0.1.tgz"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          }
        ]
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/file-type@5.2.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/is-stream@1.1.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/core-util-is@1.0.2",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/inherits@2.0.4",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/isarray@1.0.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/process-nextick-args@2.0.1",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/safe-buffer@5.1.2",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/string_decoder@1.1.1",
      "dependsOn": [
        "pkg:npm/safe-buffer@5.1.2"
      ]
    },
    {
      "ref": "pkg:npm/util-deprecate@1.0.2",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/readable-stream@2.3.7",
      "dependsOn": [
        "pkg:npm/core-util-is@1.0.2",
        "pkg:npm/inherits@2.0.4",
        "pkg:npm/isarray@1.0.0",
        "pkg:npm/process-nextick-args@2.0.1",
        "pkg:npm/safe-buffer@5.1.2",
        "pkg:npm/string_decoder@1.1.1",
        "pkg:npm/util-deprecate@1.0.2"
      ]
    },
    {
      "ref": "pkg:npm/safe-buffer@5.2.1",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/bl@1.2.3",
      "dependsOn": [
        "pkg:npm/readable-stream@2.3.7",
        "pkg:npm/safe-buffer@5.2.1"
      ]
    },
    {
      "ref": "pkg:npm/buffer-alloc-unsafe@1.1.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/buffer-fill@1.0.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/buffer-alloc@1.2.0",
      "dependsOn": [
        "pkg:npm/buffer-alloc-unsafe@1.1.0",
        "pkg:npm/buffer-fill@1.0.0"
      ]
    },
    {
      "ref": "pkg:npm/wrappy@1.0.2",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/once@1.4.0",
      "dependsOn": [
        "pkg:npm/wrappy@1.0.2"
      ]
    },
    {
      "ref": "pkg:npm/end-of-stream@1.4.4",
      "dependsOn": [
        "pkg:npm/once@1.4.0"
      ]
    },
    {
      "ref": "pkg:npm/fs-constants@1.0.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/to-buffer@1.1.1",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/xtend@4.0.2",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/tar-stream@1.6.2",
      "dependsOn": [
        "pkg:npm/bl@1.2.3",
        "pkg:npm/buffer-alloc@1.2.0",
        "pkg:npm/end-of-stream@1.4.4",
        "pkg:npm/fs-constants@1.0.0",
        "pkg:npm/readable-stream@2.3.7",
        "pkg:npm/to-buffer@1.1.1",
        "pkg:npm/xtend@4.0.2"
      ]
    },
    {
      "ref": "pkg:npm/decompress-tar@4.1.1",
      "dependsOn": [
        "pkg:npm/file-type@5.2.0",
        "pkg:npm/is-stream@1.1.0",
        "pkg:npm/tar-stream@1.6.2"
      ]
    },
    {
      "ref": "pkg:npm/file-type@6.2.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/commander@2.20.3",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/seek-bzip@1.0.6",
      "dependsOn": [
        "pkg:npm/commander@2.20.3"
      ]
    },
    {
      "ref": "pkg:npm/base64-js@1.5.1",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/ieee754@1.2.1",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/buffer@5.7.1",
      "dependsOn": [
        "pkg:npm/base64-js@1.5.1",
        "pkg:npm/ieee754@1.2.1"
      ]
    },
    {
      "ref": "pkg:npm/through@2.3.8",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/unbzip2-stream@1.4.3",
      "dependsOn": [
        "pkg:npm/buffer@5.7.1",
        "pkg:npm/through@2.3.8"
      ]
    },
    {
      "ref": "pkg:npm/decompress-tarbz2@4.1.1",
      "dependsOn": [
        "pkg:npm/decompress-tar@4.1.1",
        "pkg:npm/file-type@6.2.0",
        "pkg:npm/is-stream@1.1.0",
        "pkg:npm/seek-bzip@1.0.6",
        "pkg:npm/unbzip2-stream@1.4.3"
      ]
    },
    {
      "ref": "pkg:npm/decompress-targz@4.1.1",
      "dependsOn": [
        "pkg:npm/decompress-tar@4.1.1",
        "pkg:npm/file-type@5.2.0",
        "pkg:npm/is-stream@1.1.0"
      ]
    },
    {
      "ref": "pkg:npm/file-type@3.9.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/object-assign@4.1.1",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/pinkie@2.0.4",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/pinkie-promise@2.0.1",
      "dependsOn": [
        "pkg:npm/pinkie@2.0.4"
      ]
    },
    {
      "ref": "pkg:npm/get-stream@2.3.1",
      "dependsOn": [
        "pkg:npm/object-assign@4.1.1",
        "pkg:npm/pinkie-promise@2.0.1"
      ]
    },
    {
      "ref": "pkg:npm/pify@2.3.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/buffer-crc32@0.2.13",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/pend@1.2.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/fd-slicer@1.1.0",
      "dependsOn": [
        "pkg:npm/pend@1.2.0"
      ]
    },
    {
      "ref": "pkg:npm/yauzl@2.10.0",
      "dependsOn": [
        "pkg:npm/buffer-crc32@0.2.13",
        "pkg:npm/fd-slicer@1.1.0"
      ]
    },
    {
      "ref": "pkg:npm/decompress-unzip@4.0.1",
      "dependsOn": [
        "pkg:npm/file-type@3.9.0",
        "pkg:npm/get-stream@2.3.1",
        "pkg:npm/pify@2.3.0",
        "pkg:npm/yauzl@2.10.0"
      ]
    },
    {
      "ref": "pkg:npm/graceful-fs@4.2.6",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/pify@3.0.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/make-dir@1.3.0",
      "dependsOn": [
        "pkg:npm/pify@3.0.0"
      ]
    },
    {
      "ref": "pkg:npm/is-natural-number@4.0.1",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/strip-dirs@2.1.0",
      "dependsOn": [
        "pkg:npm/is-natural-number@4.0.1"
      ]
    },
    {
      "ref": "pkg:npm/decompress@4.2.1",
      "dependsOn": [
        "pkg:npm/decompress-tar@4.1.1",
        "pkg:npm/decompress-tarbz2@4.1.1",
        "pkg:npm/decompress-targz@4.1.1",
        "pkg:npm/decompress-unzip@4.0.1",
        "pkg:npm/graceful-fs@4.2.6",
        "pkg:npm/make-dir@1.3.0",
        "pkg:npm/pify@2.3.0",
        "pkg:npm/strip-dirs@2.1.0"
      ]
    },
    {
      "ref": "pkg:npm/create-astro@0.0.2",
      "dependsOn": [
        "pkg:npm/decompress@4.2.1"
      ]
    }
  ],
  "annotations": [
    {
      "bom-ref": "metadata-annotations",
      "subjects": [
        "pkg:npm/create-astro@0.0.2"
      ],
      "annotator": {
        "component": {
          "group": "@cyclonedx",
          "name": "cdxgen",
          "version": "12.8.4",
          "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.4",
          "type": "application",
          "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.4",
          "publisher": "OWASP Foundation",
          "authors": [
            {
              "name": "OWASP Foundation"
            }
          ]
        }
      },
      "timestamp": "2026-09-14T04:16:50Z",
      "text": "This Software Bill-of-Materials (SBOM) document was created on Monday, September 14, 2026 with cdxgen. The data was captured during the pre-build lifecycle phase without building the application. The document describes an application named 'create-astro' with version '0.0.2'."
    }
  ]
}