A CycloneDX SBOM for npm, in one command

npx -y https://licensegate.org/dl/licensegate.tgz --prod --sbom sbom.cdx.json

The file follows CycloneDX 1.5. It includes each package with its purl (pkg:npm/%40scope/name@1.2.3), its licence as an SPDX id or expression, and your project as the root component. Most SBOM tools can read it: Dependency-Track, GitHub’s dependency graph uploaders, and the questionnaires security teams send.

Who asks for an SBOM

• Enterprise customers, in security questionnaires and vendor onboarding.
• Buyers of a software business, during due diligence.
• The EU Cyber Resilience Act. Manufacturers of products with digital elements must keep an SBOM in their technical documentation. Vulnerability reporting starts on 11 September 2026; the rest applies from 11 December 2027.
• US federal suppliers, following Executive Order 14028.

In CI, on every release

- run: npm ci
- run: npx -y https://licensegate.org/dl/licensegate.tgz --mode saas --prod --sbom sbom.cdx.json
- uses: actions/upload-artifact@v4
  with: { name: sbom, path: sbom.cdx.json }

The same step checks licences against how you ship, so the SBOM and the licence gate come from one tool and one run.