CycloneDX Node.js

At a glance

• Editor score
  6.2 / 10
• Pricing
  Free plan
• Best for
  npm projects needing reproducible CycloneDX output
• Free plan
  Yes
• Paid from
  Free
• Source code input
  Yes
• Facts checked
  14 Nov 2026

• Where it wins

  • Supports npm workspaces, with workspace selection and root-inclusion options
  • Produces reproducible JSON or XML across CycloneDX versions 1.2 through 1.7
  • Can validate the BOM and gather license-text evidence from components

• Where it doesn't

  • Its verified scope is limited to npm dependency data
  • Requires Node.js and npm
  • Does not provide SPDX output or container-image and binary input

Our verdict on CycloneDX Node.js

CycloneDX Node.js is a command-line tool for generating software bills of materials from Node.js npm projects. It is suited to teams that need CycloneDX output from npm dependency data, including projects organized into workspaces. The tool accepts a package-manifest path, defaulting to package.json in the working directory, and can be installed at project level, through npx, or globally. It requires Node.js and npm, so it is a fit for environments already using that toolchain rather than teams seeking a standalone interface or broader source types.

Its output options are a central strength for projects with repeatable reporting needs. Users can select CycloneDX specification versions 1.2 through 1.7 and generate JSON or XML, writing the result to a file or standard output. Reproducible output is supported, and the resulting BOM can be validated before output. Workspace selection and root-inclusion options provide control over which parts of an npm workspace are represented. The tool can also gather license-text evidence from components. These capabilities make it useful when a project needs consistent CycloneDX artifacts integrated into a build pipeline, without implying support for formats beyond JSON and XML.

The scope is deliberately tied to npm: it collects package evidence through npm, and its verified coverage is limited to npm dependency data. It can use only the npm lock file instead of node_modules, which gives projects an alternate dependency-data source. The tool is free and open source, but it does not generate SPDX output or accept container-image and binary input. Choose it for npm-based workflows that need reproducible CycloneDX output and validation; consider another tool if the SBOM process must cover other input types or produce SPDX.

Your product? Our editors can test CycloneDX Node.js in depth and publish a review, labelled as paid · from $149/mo →

CycloneDX Node.js pricing

CycloneDX Node.js fact sheet

Alternatives to CycloneDX Node.js

• Docker ScoutGenerates and displays SBOMs alongside vulnerability analysis for container images.8.7
• Amazon InspectorA managed AWS security service that pairs continuous scanning with SBOM exports.8.6
• TrivyA free, self-hosted SBOM generator that also scans code, containers, Kubernetes, and AWS.8.5

See all CycloneDX Node.js alternatives →

Featured on iTechGuides

CycloneDX Node.js is listed in our SBOM Generation Tools directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/cyclonedx-node-js/"><img src="https://www.itechguides.com/best/badge/cyclonedx-node-js.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 14 Nov 2026 · How we research and update