TypeScript icon, indicating that this package has built-in type declarations

    1.5.1 • Public • Published

    shield_gh-workflow-test shield_npm-version shield_license
    shield_website shield_slack shield_groups shield_twitter-follow

    CycloneDX JavaScript Library

    Core functionality of CycloneDX for JavaScript (Node.js or WebBrowsers), written in TypeScript and compiled for the target.


    • Provide a general purpose JavaScript-implementation of CycloneDX for Node.js and WebBrowsers.
    • Provide typing for said implementation, so developers and dev-tools can rely on it.
    • Provide data models to work with CycloneDX.
    • Provide a JSON- and an XML-normalizer, that...
      • supports all shipped data models.
      • respects any injected CycloneDX Specification and generates valid output according to it.
      • can be configured to generate reproducible/deterministic output.
      • can prepare data structures for JSON- and XML-serialization.
    • Serialization:
      • Provide a universal JSON-serializer for all target environments.
      • Provide an XML-serializer for all target environments.
      • Support the downstream implementation of custom XML-serializers tailored to specific environments
        by providing an abstract base class that takes care of normalization and BomRef-discrimination.
        This is done, because there is no universal XML support in JavaScript.


    • Enums for the following use cases:
      • AttachmentEncoding
      • ComponentScope
      • ComponentType
      • ExternalReferenceType
      • HashAlgorithm
    • Data models for the following use cases:
      • Attachment
      • Bom
      • BomRef, BomRefRepository
      • Component, ComponentRepository
      • ExternalReference, ExternalReferenceRepository
      • Hash, HashContent, HashDictionary
      • LicenseExpression, NamedLicense, SpdxLicense, LicenseRepository
      • Metadata
      • OrganizationalContact, OrganizationalContactRepository
      • OrganizationalEntity
      • Property, PropertyRepository
      • SWID
      • Tool, ToolRepository
    • Factories for the following use cases:
      • Create data models from any license descriptor string
      • Create PackageURL from Component data models
      • Specific to Node.js: create data models from PackageJson-like data structures and derived data
    • Builders for the following use cases:
      • Specific to Node.js: create deep data models Tool or Component from PackageJson-like data structures
    • Implementation of the CycloneDX Specification for the following versions:
      • 1.4
      • 1.3
      • 1.2
    • Normalizers that convert data models to JSON structures
    • Normalizers that convert data models to XML structures
    • Universal serializer that converts Bom data models to JSON string
    • Serializer that converts Bom data models to XML string:
      • Specific to WebBrowsers: implementation utilizes browser-specific document generators and printers.
      • Specific to Node.js: implementation plugs/requires/utilizes one of the following optional libraries
        • xmlbuilder2
        • ... to be continued ... (pull requests are welcome)


    This package and the build results are available for npm, yarn and pnpm:

    npm i -S @cyclonedx/cyclonedx-library
    yarn add @cyclonedx/cyclonedx-library
    pnpm add @cyclonedx/cyclonedx-library

    You can install the package from source, which will build automatically on installation:

    npm i -S github:CycloneDX/cyclonedx-javascript-library
    # not supported with yarn
    # not supported with pnpm


    See extended examples.

    As Node.js package

    const cdx = require('@cyclonedx/cyclonedx-library')
    const bom = new cdx.Models.Bom()
      new cdx.Models.Component(

    In WebBrowsers

    <script src="path-to-this-package/dist.web/lib.js">
        // full Library is available as `CycloneDX_library`, per default
    <script type="application/javascript">
        const cdx = CycloneDX_library
        let bom = new cdx.Models.Bom()
                new cdx.Models.Component(

    Development & Contributing

    Feel free to open issues, bugreports or pull requests.
    See the CONTRIBUTING file for details.


    Permission to modify and redistribute is granted under the terms of the Apache 2.0 license.
    See the LICENSE file for the full license.


    npm i @cyclonedx/cyclonedx-library

    DownloadsWeekly Downloads






    Unpacked Size

    1.57 MB

    Total Files


    Last publish


    • cyclonedx-automation
    • jkowalleck
    • sspringett
    • eoftedal
    • coderpatros