cdxgen is an OWASP project that creates CycloneDX Bills of Materials for source code, container images, binaries and live systems: SBOM, CBOM, OBOM, SaaSBOM and more. Read the documentation to get started.
npm install -g @cdxgen/cdxgen| Repository | What it is |
|---|---|
| cdxgen | The BOM generator: CLI, library, HTTP server and REPL |
| cdxgen-plugins-bin | Native helper binaries that cdxgen uses for deeper analysis |
| cdx-purl | Strict package-url parser and builder for Node.js |
| cdx-proto | Read and write CycloneDX BOMs as protocol buffers |
| cdx-hbom | Hardware Bill of Materials library |
| safer-exec | OS-level sandboxing with tracing and auditing for any binary |
| caxa | Packages Node.js applications into single executables |
- Ask questions and share ideas in Discussions.
- Read the contributing guide before opening a pull request.
- Report vulnerabilities privately, as described in the security policy.
We build cdxgen with the help of AI coding agents and say so openly. Each repository has an AI-DECLARATION.md that describes how AI is used there, and pull requests made with AI carry an ai-* label for the level of AI involvement.
