Is @cyclonedx/bom safe to use?

@cyclonedx/bom has no known vulnerabilities on the latest version (4.1.5). DepScope rates its health at 60/100 (moderate risk).

What is the latest version of @cyclonedx/bom?

The latest version of @cyclonedx/bom is 4.1.5, released 2026-03-19.

Does @cyclonedx/bom have known vulnerabilities?

No known vulnerabilities on the latest version of @cyclonedx/bom.

Is @cyclonedx/bom deprecated?

No, @cyclonedx/bom is actively maintained. Latest release: 4.1.5 (2026-03-19).

What are alternatives to @cyclonedx/bom?

Popular alternatives to @cyclonedx/bom in npm include: ?, semver, minimatch, debug, brace-expansion.

What license does @cyclonedx/bom use?

@cyclonedx/bom is licensed under Apache-2.0.

@cyclonedx/bom

npmv4.1.5

Meta-package for known CycloneDX Software Bill of Materials (SBOM) generators

License Apache-2.0permissive66 versions5 maintainers0 deps

CycloneDX/cyclonedx-node-module

/ 100

Health

use with caution

@cyclonedx/[email protected] low health (60/100) — consider alternatives

Moderate health score (60/100) — verify manually

Health breakdown0 – 100

15/25

maintenance

0/20

popularity

25/25

security

15/15

maturity

5/15

community

Vulnerabilities

none known

Bundle & TypeScript

🌟

TypeScript

0/10untyped

No type definitions available

Health History

Dependency Tree

License Audit

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/npm/@cyclonedx/bom