SBOM — Software Bill of Materials

Why SBOMs are becoming required

In 2021, a US executive order on cybersecurity required software vendors selling to the federal government to provide SBOMs. The intent was to make it easier to respond to vulnerabilities like Log4Shell — instead of searching through thousands of systems to find which ones use Log4j, an SBOM lets you query a database and get the answer immediately.

The EU Cyber Resilience Act (2025) similarly requires SBOMs for many product categories. Even without regulatory pressure, SBOMs are becoming a standard part of enterprise software procurement — many large companies now require vendors to provide them.

SBOM formats

• CycloneDX — OWASP standard, JSON or XML, widely supported by security tools
• SPDX — Linux Foundation standard, originally focused on license compliance, now covers security too

How to generate an SBOM from your lockfile

# npm projects
npx @cyclonedx/cyclonedx-npm --output-file sbom.json

# Python
pip install cyclonedx-bom
cyclonedx-bom -o sbom.json

# Using syft (all ecosystems)
syft . -o cyclonedx-json > sbom.json

How PackageFix relates to SBOMs

PackageFix isn't an SBOM generator, but it covers the security scanning part of what SBOMs are used for. If you paste your lockfile into PackageFix, it effectively does what SBOM vulnerability scanning does — checks every component against the OSV database and CISA KEV catalog. For formal SBOM generation, use CycloneDX or syft; for quick vulnerability scanning, use PackageFix.