[npm] cdxgen does not extract name and license from package.json

[ivanasabi]

Hello,

I am using the CDXGEN CLI to generate SBOMs for various technologies, primarily for license analysis.

The command I am using is:

export FETCH_LICENSE=true
cdxgen --profile license-compliance -o sbom.json

In an npm project, I have encountered two issues:

1. For the root package, CDXGEN always uses the project folder's name as the package name instead of the one specified in package.json.
2. CDXGEN does not seem to detect licenses defined in the package.json file.

{
  "name": "@fakeosonod/code",
  "version": "0.1.0-SNAPSHOT",
  "description": "Node.js service",
  "license": "MIT"
   .....
}

"component": {
    "group": "",
    "name": "code",
    "version": "0.1.0-SNAPSHOT",
    "type": "application",
    "purl": "pkg:npm/[email protected]",
    "bom-ref": "pkg:npm/[email protected]",
    "description": "assertion library"
}

I have tried different variations of the original command without any different results:

export FETCH_LICENSE=true
cdxgen -t npm --include-formulation --profile license-compliance  -o sbom.json

Is this the expected behavior?

Thank you very much.

[prabhu]

Did you try with specifying the type? -t js to see if it helps with the parent component name and license?

[prabhu]

The code might be arriving to this line that doesn't construct a parent component. It will be similar to this. Best to refactor into a method and also add some logic to retain the license and other metadata.

[ivanasabi]

Yes, correct, I have also checked that.

The name issue has a workaround with the --project-name argument, the lack of license seems to be more problematic and requires modifying sbom.json post-build.

[prabhu]

Can you try to send a pull request?

[ivanasabi]

Of course #1503