SBOM Generation

DepAegis automatically generates a Software Bill of Materials (SBOM) for every package published to the registry. This page covers SBOM format, contents, access methods, and compliance use cases.

What is an SBOM?

A Software Bill of Materials (SBOM)is a formal, machine-readable inventory of all components that make up a piece of software. It lists every dependency, its version, its supplier, and other metadata — similar to an ingredients list on food packaging.

SBOMs are a cornerstone of modern software supply chain security. They enable:

Vulnerability impact analysis — quickly determine if a newly disclosed CVE affects your software.
License compliance — audit all licenses in your dependency tree.
Regulatory compliance — meet requirements from the EU Cyber Resilience Act and US Executive Order 14028.
Transparency — give consumers full visibility into what they are installing.

DepAegis generates SBOMs automatically on publish. No configuration or extra tooling is required. The SBOM is stored alongside the package and is accessible from the dashboard and the API.

CycloneDX Format

DepAegis generates SBOMs in CycloneDX format (XML and JSON), the industry-standard SBOM format managed by the OWASP Foundation. CycloneDX is widely supported by security tools, compliance platforms, and dependency management systems.

A minimal CycloneDX SBOM for an npm package looks like this:

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "version": 1,
  "metadata": {
    "component": {
      "type": "library",
      "name": "@myorg/ui-components",
      "version": "1.2.3",
      "purl": "pkg:npm/@myorg/ui-components@1.2.3"
    },
    "timestamp": "2026-06-11T10:00:00Z",
    "tools": [
      { "name": "DepAegis", "version": "2.0.0" }
    ]
  },
  "components": [
    {
      "type": "library",
      "name": "lodash",
      "version": "4.17.21",
      "purl": "pkg:npm/lodash@4.17.21",
      "hashes": [
        { "alg": "SHA-512", "content": "d8a..." }
      ],
      "licenses": [
        { "license": { "id": "MIT" } }
      ]
    }
  ]
}

Auto-Generation on Publish

When a package is published, DepAegis performs the following steps:

Extract the package tarball and parse the dependency manifest (package-lock.json, packages.lock.json, or container image layers).
Resolve the full dependency tree, including transitive dependencies.
Enrich each component with license information, hashes, and package URLs (purl).
Generate the CycloneDX document in JSON and XML formats.
Attach the SBOM to the package version as a first-class artifact.

The entire process takes less than five seconds for most packages.

SBOM Contents

Each generated SBOM includes the following information:

Field	Description
Components	Every direct and transitive dependency with name, version, and ecosystem.
Licenses	SPDX license identifiers for each component (where detectable).
Hashes	SHA-256 and SHA-512 checksums for each component artifact.
Package URLs (purl)	Standardized package identifiers following the purl specification.
Supplier / Author	Publisher information where available.
Dependency relationships	Which components depend on which, forming the full dependency graph.

Downloading SBOM from the Dashboard

To download an SBOM for a specific package version:

Navigate to the package in the DepAegis dashboard.
Select the desired version.
Click the SBOM tab.
Download in JSON or XML format.

The SBOM can also be downloaded as part of the package’s artifact bundle, which includes the tarball, signature, provenance, and SBOM in a single zip file.

API Access to SBOM

SBOMs are accessible via the DepAegis REST API for integration into your own tooling:

# Download SBOM in JSON format
curl -H "Authorization: Bearer $DEPAEGIS_TOKEN" \
  "https://app.depaegis.com/api/v1/packages/@myorg%2Fui-components/versions/1.2.3/sbom" \
  -o sbom.json

# Download SBOM in XML format
curl -H "Authorization: Bearer $DEPAEGIS_TOKEN" \
  "https://app.depaegis.com/api/v1/packages/@myorg%2Fui-components/versions/1.2.3/sbom?format=xml" \
  -o sbom.xml

The API also supports querying SBOM data directly:

# List all components in the SBOM
curl -H "Authorization: Bearer $DEPAEGIS_TOKEN" \
  "https://app.depaegis.com/api/v1/packages/@myorg%2Fui-components/versions/1.2.3/sbom/components"

Compliance Use Cases

EU Cyber Resilience Act (CRA)

The EU Cyber Resilience Act requires that products with digital elements be accompanied by an SBOM for vulnerability management and incident response. DepAegis SBOMs satisfy CRA requirements by providing:

A complete, machine-readable inventory of all software components.
Automated vulnerability scanning against up-to-date databases.
Timestamped, versioned SBOMs that can be produced on demand for auditors.

US Executive Order 14028

The US Executive Order on Improving the Nation’s Cybersecurity requires federal software suppliers to provide an SBOM for each product. DepAegis SBOMs meet NTIA’s minimum elements:

Author and component name
Version string
Dependency relationship
Timestamp of SBOM generation

For regulated industries, export SBOMs from DepAegis and ingest them into your compliance platform (e.g. Dependency-Track, GUAC, or FOSSA) for continuous monitoring and audit readiness.

Integration with Dependency Management Tools

DepAegis SBOMs integrate with popular supply chain security tools:

Dependency-Track— ingest CycloneDX SBOMs for continuous vulnerability monitoring across your entire portfolio.
GUAC (Graph for Understanding Artifact Composition)— build a knowledge graph of your software supply chain from SBOMs, SLSA attestations, and vulnerability data.
SBOMit / Syft— compare DepAegis-generated SBOMs against locally generated ones for tamper detection.

# Ingest DepAegis SBOM into Dependency-Track
curl -X POST \
  -H "X-API-Key: $DT_API_KEY" \
  -H "Content-Type: multipart/form-data" \
  -F "bom=@sbom.json" \
  "https://dtrack.example.com/api/v1/bom"

← Previous

Vulnerability Scanning

Dependency Firewall