{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a62103bc-9377-45b2-8613-7010d71f38b8",
  "version": 1,
  "metadata": {
    "timestamp": "2026-09-20T13:18:31.582375",
    "tools": {
      "components": [
        {
          "type": "application",
          "name": "ESL SBOMator",
          "version": "1.4.8",
          "publisher": "Engineering Software Lab (ESL)",
          "externalReferences": [
            {
              "type": "website",
              "url": "https://www.eswlab.com"
            }
          ]
        },
        {
          "type": "application",
          "name": "syft",
          "version": "1.39.0",
          "author": "anchore"
        },
        {
          "type": "application",
          "name": "cdxgen",
          "group": "@cyclonedx",
          "version": "12.0.0",
          "publisher": "OWASP Foundation",
          "purl": "pkg:npm/%40cyclonedx/cdxgen@12.0.0",
          "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.0.0"
        }
      ]
    },
    "component": {
      "type": "application",
      "name": "MantiQ-Solidity",
      "version": "0.0.0+git.8ff48e7-dirty",
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ],
      "manufacturer": {
        "name": "E.S.L SOFTWARE LAB LTD"
      },
      "supplier": {
        "name": "E.S.L SOFTWARE LAB LTD"
      },
      "bom-ref": "urn:sbomator:product:MantiQ-Solidity@0.0.0+git.8ff48e7-dirty"
    },
    "properties": [
      {
        "name": "esl:nvd_snapshot",
        "value": "2026-09-20T13:20:10.992626"
      },
      {
        "name": "esl:osv_snapshot",
        "value": "2026-09-20T13:20:10.992626"
      },
      {
        "name": "esl:offline_mode",
        "value": "true"
      },
      {
        "name": "esl:proprietary_filtered",
        "value": "0"
      },
      {
        "name": "esl:metadata:esl_cpp_scan",
        "value": "{\"capabilities\": {\"detected_systems\": [], \"has_cpp_evidence\": false, \"manual_review_systems\": [], \"partial_systems\": [], \"source_file_count\": 0, \"supported_systems\": [], \"warnings\": []}, \"components_found\": {\"cmake\": 0, \"conan\": 0, \"manual\": 0, \"total\": 0, \"west\": 0}, \"coverage_percentage\": 0.0, \"parsers_run\": [\"embedded_rtos\"], \"warnings\": []}"
      },
      {
        "name": "esl:metadata:esl_comprehensive_scan",
        "value": "{\"cpp_detection\": {\"capabilities\": {\"detected_systems\": [], \"has_cpp_evidence\": false, \"manual_review_systems\": [], \"partial_systems\": [], \"source_file_count\": 0, \"supported_systems\": [], \"warnings\": []}, \"components_found\": {\"cmake\": 0, \"conan\": 0, \"manual\": 0, \"total\": 0, \"west\": 0}, \"coverage_percentage\": 0.0, \"parsers_run\": [\"embedded_rtos\"], \"warnings\": []}, \"scan_date\": \"2026-09-20T13:18:33.192416\", \"scan_mode\": \"comprehensive\", \"scan_summary\": {\"cdxgen\": 67, \"syft\": 315}, \"tools_attempted\": 2, \"tools_successful\": 2}"
      },
      {
        "name": "esl:metadata:esl_secret_scan",
        "value": "{\"available\": false, \"error\": \"gitleaks binary not found\", \"files_affected\": 0, \"findings\": [], \"findings_count\": 0, \"redacted\": true, \"rules_triggered\": 0, \"scan_mode\": \"dir\", \"status\": \"not_installed\", \"tool\": \"gitleaks\", \"version\": \"\"}"
      },
      {
        "name": "esl:metadata:esl_hash_generation",
        "value": "{\"components_with_hashes\": 316, \"data_source\": \"offline-local-only\", \"hash_algorithms\": [\"SHA-256\", \"SHA-512\", \"SHA-1\"], \"scope\": \"Python local files, Maven Central, Go modules, npm registry, crates.io\", \"total_components\": 371}"
      },
      {
        "name": "esl:metadata:esl_supplier_enrichment",
        "value": "{\"components_with_real_supplier\": 88, \"components_with_supplier\": 371, \"data_source\": \"offline-local-only\", \"enriched_count\": 368, \"fda_compliance\": \"supplier_field_populated\", \"last_network_errors\": {}, \"network_failures\": {}, \"total_components\": 371}"
      },
      {
        "name": "esl:metadata:esl_license_enrichment",
        "value": "{\"api_calls\": 0, \"by_ecosystem\": {}, \"cache_hits\": 0, \"coverage_percentage\": 79.25, \"data_source\": \"offline-cache-only\", \"enriched_components\": 0, \"enrichment_date\": \"2026-09-20T13:19:48.199458\", \"normalized_existing_licenses\": 0, \"pre_existing_licenses\": 294, \"total_components\": 371, \"total_with_license\": 294}"
      },
      {
        "name": "esl:metadata:esl_lifecycle_enrichment",
        "value": "{\"active_components\": 0, \"classified_count\": 0, \"enriched_count\": 0, \"enrichment_date\": \"2026-09-20T13:19:25.784260\", \"eol_components\": 0, \"last_network_errors\": {}, \"lifecycle_coverage_by_ecosystem\": {\"generic\": {\"classified\": 0, \"queried\": 3, \"total\": 3, \"unknown\": 3}, \"npm\": {\"classified\": 0, \"queried\": 368, \"total\": 368, \"unknown\": 368}}, \"maintenance_components\": 0, \"network_failures\": {}, \"queried_count\": 371, \"total_components\": 371, \"unknown_status\": 371}"
      },
      {
        "name": "esl:metadata:osv_enhancement",
        "value": "{\"database_stats\": {\"database_path\": \"AppData/Roaming/ESL/SBOMator/osv_local/osv.db\", \"database_size\": 181968896, \"ecosystem_stats\": {\"Echo\": 2, \"Go\": 9193, \"Hex\": 2, \"Maven\": 6988, \"NuGet\": 9, \"Packagist\": 10, \"PyPI\": 25512, \"RubyGems\": 19, \"SwiftURL\": 3, \"crates.io\": 2804, \"npm\": 228912}, \"severity_stats\": {\"\": 247190, \"CRITICAL\": 4126, \"HIGH\": 9888, \"LOW\": 1245, \"MEDIUM\": 10964, \"NONE\": 41}, \"total_vulnerabilities\": 273454}, \"enhanced_components\": 4, \"scan_timestamp\": \"2026-09-20T13:20:08.736240\", \"scanner\": \"local_osv\", \"total_vulnerabilities\": 8}"
      },
      {
        "name": "esl:metadata:vulnerability_analysis",
        "value": "{\"cve_analysis_coverage\": {\"matched\": 4, \"not_analyzed\": 0, \"scanned_clean\": 364}, \"enhanced_components\": 0, \"enhancement_date\": \"2026-09-20T13:20:09.388936\", \"hallusquat_database_available\": true, \"hallusquat_findings\": [{\"confidence\": \"high\", \"ecosystem\": \"npm\", \"evidence\": \"OSV malicious-package record MAL-2025-46966 (source: osv_mal)\", \"finding_type\": \"confirmed_malicious\", \"package_name\": \"ansi-regex\", \"severity\": \"high\"}, {\"confidence\": \"high\", \"ecosystem\": \"npm\", \"evidence\": \"OSV malicious-package record MAL-2025-46967 (source: osv_mal)\", \"finding_type\": \"confirmed_malicious\", \"package_name\": \"ansi-styles\", \"severity\": \"high\"}, {\"confidence\": \"high\", \"ecosystem\": \"npm\", \"evidence\": \"OSV malicious-package record MAL-2025-46969 (source: osv_mal)\", \"finding_type\": \"confirmed_malicious\", \"package_name\": \"chalk\", \"severity\": \"high\"}, {\"confidence\": \"high\", \"ecosystem\": \"npm\", \"evidence\": \"OSV malicious-package record MAL-2025-46971 (source: osv_mal)\", \"finding_type\": \"confirmed_malicious\", \"package_name\": \"color-convert\", \"severity\": \"high\"}, {\"confidence\": \"high\", \"ecosystem\": \"npm\", \"evidence\": \"OSV malicious-package record MAL-2025-46972 (source: osv_mal)\", \"finding_type\": \"confirmed_malicious\", \"package_name\": \"color-name\", \"severity\": \"high\"}, {\"confidence\": \"high\", \"ecosystem\": \"npm\", \"evidence\": \"OSV malicious-package record MAL-2025-46974 (source: osv_mal)\", \"finding_type\": \"confirmed_malicious\", \"package_name\": \"debug\", \"severity\": \"high\"}, {\"confidence\": \"high\", \"ecosystem\": \"npm\", \"evidence\": \"OSV malicious-package record MAL-2023-462 (source: osv_mal)\", \"finding_type\": \"confirmed_malicious\", \"package_name\": \"fsevents\", \"severity\": \"high\"}, {\"confidence\": \"high\", \"ecosystem\": \"npm\", \"evidence\": \"OSV malicious-package record MAL-2025-46980 (source: osv_mal)\", \"finding_type\": \"confirmed_malicious\", \"package_name\": \"strip-ansi\", \"severity\": \"high\"}, {\"confidence\": \"high\", \"ecosystem\": \"npm\", \"evidence\": \"OSV malicious-package record MAL-2025-46981 (source: osv_mal)\", \"finding_type\": \"confirmed_malicious\", \"package_name\": \"supports-color\", \"severity\": \"high\"}, {\"confidence\": \"high\", \"ecosystem\": \"npm\", \"evidence\": \"OSV malicious-package record MAL-2025-46981 (source: osv_mal)\", \"finding_type\": \"confirmed_malicious\", \"package_name\": \"supports-color\", \"severity\": \"high\"}, {\"confidence\": \"high\", \"ecosystem\": \"npm\", \"evidence\": \"OSV malicious-package record MAL-2025-46983 (source: osv_mal)\", \"finding_type\": \"confirmed_malicious\", \"package_name\": \"wrap-ansi\", \"severity\": \"high\"}], \"hallusquat_findings_count\": 11, \"scan_mode\": \"local_osv\", \"source\": \"Local OSV database (offline / local databases)\", \"sources\": [{\"components_covered\": 371, \"database\": {\"database_path\": \"AppData/Roaming/ESL/SBOMator/osv_local/osv.db\", \"database_size\": 181968896, \"ecosystem_stats\": {\"Echo\": 2, \"Go\": 9193, \"Hex\": 2, \"Maven\": 6988, \"NuGet\": 9, \"Packagist\": 10, \"PyPI\": 25512, \"RubyGems\": 19, \"SwiftURL\": 3, \"crates.io\": 2804, \"npm\": 228912}, \"severity_stats\": {\"\": 247190, \"CRITICAL\": 4126, \"HIGH\": 9888, \"LOW\": 1245, \"MEDIUM\": 10964, \"NONE\": 41}, \"total_vulnerabilities\": 273454}, \"name\": \"Local OSV database\", \"reason\": \"\", \"status\": \"completed\"}, {\"components_covered\": 0, \"name\": \"Grype\", \"reason\": \"Grype disabled by scan options\", \"status\": \"skipped\"}], \"total_components\": 371, \"total_cves_added\": 15}"
      },
      {
        "name": "esl:metadata:esl_generation",
        "value": "{\"generator\": \"comprehensive\", \"options\": {\"ai_check_level\": \"medium\", \"ai_sbom_enabled\": false, \"cyclonedx_version\": \"1.6\", \"format\": \"cyclonedx-json\", \"include_cves\": true, \"max_cves_per_component\": 5, \"scan_public_code\": false}, \"project_detection\": {\"build_systems\": [], \"languages\": [\"python\", \"javascript\"], \"package_managers\": [\"npm\"], \"project_type\": \"npm\", \"recommended_tools\": [\"cdxgen\", \"comprehensive\"], \"source_type\": \"git_local\"}, \"source\": \"MantiQ-Solidity\", \"source_branch\": \"main\", \"source_revision\": \"8ff48e756d1d233344ed37599b4125441c14ea50\", \"source_type\": \"local_git\", \"timestamp\": \"2026-09-20T13:20:08.847848\"}"
      },
      {
        "name": "esl:metadata:esl:orphaned_vulnerabilities",
        "value": "[{\"affects\": [{\"ref\": \"pkg:generic/curl@7.22.0\", \"versions\": [{\"status\": \"unknown\", \"version\": \"7.69.0 to 7.84.0\"}]}], \"analysis\": {\"detail\": \"Installed component version is outside the affected range for this CVE (version-aware guard).\", \"justification\": \"code_not_present\", \"state\": \"not_affected\"}, \"esl_kev_analysis\": {\"weaponized\": false}, \"esl_priority\": \"STANDARD\", \"id\": \"CVE-2022-32207\", \"properties\": [{\"name\": \"detection:method\", \"value\": \"binary_pattern_match\"}, {\"name\": \"detection:confidence\", \"value\": \"low\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/@noble/hashes/src/sha3.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/@types/node/http.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/@types/node/http2.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/@types/node/https.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/command-exists/.jshintrc\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ethers/dist/ethers.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ethers/dist/ethers.umd.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ethers/dist/wordlists-extra.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/dist/node/0.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/dist/node/1.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/dist/node/4.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/dist/web/ganache.min.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/lib/tsserverlibrary.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/lib/typescript.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/lib/typescriptServices.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/loc/lcl/CHS/TypeScriptLanguageService/Microsoft.CodeAnalysis.TypeScript.EditorFeatures.dll.lcl\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/loc/lcl/CHT/TypeScriptLanguageService/Microsoft.CodeAnalysis.TypeScript.EditorFeatures.dll.lcl\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/loc/lcl/CSY/TypeScriptLanguageService/Microsoft.CodeAnalysis.TypeScript.EditorFeatures.dll.lcl\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/loc/lcl/DEU/TypeScriptLanguageService/Microsoft.CodeAnalysis.TypeScript.EditorFeatures.dll.lcl\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/loc/lcl/ESN/TypeScriptLanguageService/Microsoft.CodeAnalysis.TypeScript.EditorFeatures.dll.lcl\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/loc/lcl/FRA/TypeScriptLanguageService/Microsoft.CodeAnalysis.TypeScript.EditorFeatures.dll.lcl\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/loc/lcl/ITA/TypeScriptLanguageService/Microsoft.CodeAnalysis.TypeScript.EditorFeatures.dll.lcl\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/loc/lcl/JPN/TypeScriptLanguageService/Microsoft.CodeAnalysis.TypeScript.EditorFeatures.dll.lcl\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/loc/lcl/KOR/TypeScriptLanguageService/Microsoft.CodeAnalysis.TypeScript.EditorFeatures.dll.lcl\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/loc/lcl/PLK/TypeScriptLanguageService/Microsoft.CodeAnalysis.TypeScript.EditorFeatures.dll.lcl\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/loc/lcl/PTB/TypeScriptLanguageService/Microsoft.CodeAnalysis.TypeScript.EditorFeatures.dll.lcl\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/loc/lcl/RUS/TypeScriptLanguageService/Microsoft.CodeAnalysis.TypeScript.EditorFeatures.dll.lcl\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/loc/lcl/TRK/TypeScriptLanguageService/Microsoft.CodeAnalysis.TypeScript.EditorFeatures.dll.lcl\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/tsdoc/lib/parser/NodeParser.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/tsdoc/lib/parser/Token.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/tsdoc/lib/parser/Token.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/tsdoc/lib/parser/Tokenizer.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/tsdoc/lib/parser/__tests__/NodeParserTags.test.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/tsdoc/lib-commonjs/parser/NodeParser.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/tsdoc/lib-commonjs/parser/Token.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/tsdoc/lib-commonjs/parser/Tokenizer.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/tsdoc/lib-commonjs/parser/__tests__/NodeParserTags.test.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/tsdoc-config/node_modules/resolve/.eslintrc\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/eslint/rules/best-practices.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/eslint/rules/ecmascript-6.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/eslint/rules/possible-errors.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/eslint/rules/stylistic-issues.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/node/http.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/node/http2.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/node/https.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/acorn/dist/acorn.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/acorn/dist/acorn.mjs\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/acorn-import-assertions/lib/index.mjs\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/des.js/.jscsrc\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/des.js/.jshintrc\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/esrecurse/node_modules/estraverse/.jshintrc\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/estraverse/.jshintrc\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/js-yaml/dist/js-yaml.mjs\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/json-schema-traverse/.eslintrc.yml\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/minimist/.eslintrc\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/mocha/mocha.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/require-directory/.jshintrc\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/resolve/.eslintrc\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/typescript/lib/tsserverlibrary.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/typescript/lib/typescript.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/xtend/.jshintrc\"}, {\"name\": \"esl:suppression_source\", \"value\": \"cve_exclusions.json\"}, {\"name\": \"esl:earliest_public_at\", \"value\": \"2022-07-07T13:15:08.403000Z\"}, {\"name\": \"esl:earliest_source\", \"value\": \"nvd\"}, {\"name\": \"esl:disclosure_lag_days\", \"value\": \"0\"}, {\"name\": \"esl:response_due_at\", \"value\": \"2022-07-21T13:15:08.403000Z\"}, {\"name\": \"esl:response_status\", \"value\": \"overdue\"}, {\"name\": \"esl:fix_available\", \"value\": \"unknown\"}, {\"name\": \"esl:fix_fixed_versions\", \"value\": \"[]\"}, {\"name\": \"esl:fix_recommended_version\", \"value\": \"\"}, {\"name\": \"esl:fix_recommended_is_major_bump\", \"value\": \"false\"}, {\"name\": \"esl:fix_first_available_at\", \"value\": \"\"}, {\"name\": \"esl:remediation_age_days\", \"value\": \"\"}, {\"name\": \"esl:fix_sources\", \"value\": \"[]\"}, {\"name\": \"esl:fix_reason\", \"value\": \"registry_not_evaluated\"}, {\"name\": \"esl:cve_year\", \"value\": \"2022\"}, {\"name\": \"esl:age_days\", \"value\": \"1535\"}, {\"name\": \"esl:dormant\", \"value\": \"false\"}], \"source\": {\"name\": \"ESL-SBOMator CVE Pattern Detector\", \"url\": \"https://nvd.nist.gov/vuln/detail/CVE-2022-32207\"}}, {\"affects\": [{\"ref\": \"pkg:generic/curl@7.22.0\", \"versions\": [{\"status\": \"unknown\", \"version\": \"7.20.0 to 7.78.0\"}]}], \"analysis\": {\"detail\": \"Crafted server response can bypass STARTTLS requirement and proceed with cleartext transfer.\", \"state\": \"under_investigation\"}, \"esl_kev_analysis\": {\"weaponized\": false}, \"esl_priority\": \"STANDARD\", \"id\": \"CVE-2021-22946\", \"properties\": [{\"name\": \"detection:method\", \"value\": \"binary_pattern_match\"}, {\"name\": \"detection:confidence\", \"value\": \"low\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/@noble/hashes/src/sha3.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/@types/node/http.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/@types/node/http2.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/@types/node/https.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/command-exists/.jshintrc\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ethers/dist/ethers.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ethers/dist/ethers.umd.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ethers/dist/wordlists-extra.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/dist/node/0.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/dist/node/1.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/dist/node/4.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/dist/web/ganache.min.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/lib/tsserverlibrary.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/lib/typescript.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/lib/typescriptServices.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/loc/lcl/CHS/TypeScriptLanguageService/Microsoft.CodeAnalysis.TypeScript.EditorFeatures.dll.lcl\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/loc/lcl/CHT/TypeScriptLanguageService/Microsoft.CodeAnalysis.TypeScript.EditorFeatures.dll.lcl\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/loc/lcl/CSY/TypeScriptLanguageService/Microsoft.CodeAnalysis.TypeScript.EditorFeatures.dll.lcl\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/loc/lcl/DEU/TypeScriptLanguageService/Microsoft.CodeAnalysis.TypeScript.EditorFeatures.dll.lcl\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/loc/lcl/ESN/TypeScriptLanguageService/Microsoft.CodeAnalysis.TypeScript.EditorFeatures.dll.lcl\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/loc/lcl/FRA/TypeScriptLanguageService/Microsoft.CodeAnalysis.TypeScript.EditorFeatures.dll.lcl\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/loc/lcl/ITA/TypeScriptLanguageService/Microsoft.CodeAnalysis.TypeScript.EditorFeatures.dll.lcl\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/loc/lcl/JPN/TypeScriptLanguageService/Microsoft.CodeAnalysis.TypeScript.EditorFeatures.dll.lcl\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/loc/lcl/KOR/TypeScriptLanguageService/Microsoft.CodeAnalysis.TypeScript.EditorFeatures.dll.lcl\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/loc/lcl/PLK/TypeScriptLanguageService/Microsoft.CodeAnalysis.TypeScript.EditorFeatures.dll.lcl\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/loc/lcl/PTB/TypeScriptLanguageService/Microsoft.CodeAnalysis.TypeScript.EditorFeatures.dll.lcl\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/loc/lcl/RUS/TypeScriptLanguageService/Microsoft.CodeAnalysis.TypeScript.EditorFeatures.dll.lcl\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/api-extractor/node_modules/typescript/loc/lcl/TRK/TypeScriptLanguageService/Microsoft.CodeAnalysis.TypeScript.EditorFeatures.dll.lcl\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/tsdoc/lib/parser/NodeParser.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/tsdoc/lib/parser/Token.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/tsdoc/lib/parser/Token.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/tsdoc/lib/parser/Tokenizer.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/tsdoc/lib/parser/__tests__/NodeParserTags.test.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/tsdoc/lib-commonjs/parser/NodeParser.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/tsdoc/lib-commonjs/parser/Token.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/tsdoc/lib-commonjs/parser/Tokenizer.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/tsdoc/lib-commonjs/parser/__tests__/NodeParserTags.test.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@microsoft/tsdoc-config/node_modules/resolve/.eslintrc\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/eslint/rules/best-practices.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/eslint/rules/ecmascript-6.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/eslint/rules/possible-errors.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/eslint/rules/stylistic-issues.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/node/http.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/node/http2.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/node/https.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/acorn/dist/acorn.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/acorn/dist/acorn.mjs\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/acorn-import-assertions/lib/index.mjs\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/des.js/.jscsrc\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/des.js/.jshintrc\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/esrecurse/node_modules/estraverse/.jshintrc\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/estraverse/.jshintrc\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/js-yaml/dist/js-yaml.mjs\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/json-schema-traverse/.eslintrc.yml\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/minimist/.eslintrc\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/mocha/mocha.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/require-directory/.jshintrc\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/resolve/.eslintrc\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/typescript/lib/tsserverlibrary.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/typescript/lib/typescript.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/xtend/.jshintrc\"}, {\"name\": \"esl:earliest_public_at\", \"value\": \"2021-09-29T20:15:08.187000Z\"}, {\"name\": \"esl:earliest_source\", \"value\": \"nvd\"}, {\"name\": \"esl:disclosure_lag_days\", \"value\": \"0\"}, {\"name\": \"esl:response_due_at\", \"value\": \"2021-10-13T20:15:08.187000Z\"}, {\"name\": \"esl:response_status\", \"value\": \"overdue\"}, {\"name\": \"esl:fix_available\", \"value\": \"unknown\"}, {\"name\": \"esl:fix_fixed_versions\", \"value\": \"[]\"}, {\"name\": \"esl:fix_recommended_version\", \"value\": \"\"}, {\"name\": \"esl:fix_recommended_is_major_bump\", \"value\": \"false\"}, {\"name\": \"esl:fix_first_available_at\", \"value\": \"\"}, {\"name\": \"esl:remediation_age_days\", \"value\": \"\"}, {\"name\": \"esl:fix_sources\", \"value\": \"[]\"}, {\"name\": \"esl:fix_reason\", \"value\": \"registry_not_evaluated\"}, {\"name\": \"esl:cve_year\", \"value\": \"2021\"}, {\"name\": \"esl:age_days\", \"value\": \"1816\"}, {\"name\": \"esl:dormant\", \"value\": \"false\"}], \"source\": {\"name\": \"ESL-SBOMator CVE Pattern Detector\", \"url\": \"https://nvd.nist.gov/vuln/detail/CVE-2021-22946\"}}, {\"affects\": [{\"ref\": \"pkg:generic/openssl@0.9.6d\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"<1.1.1n, <3.0.2\"}]}], \"analysis\": {\"detail\": \"Installed component version is outside the affected range for this CVE (version-aware guard).\", \"justification\": \"code_not_present\", \"state\": \"not_affected\"}, \"esl_kev_analysis\": {\"weaponized\": false}, \"esl_priority\": \"STANDARD\", \"id\": \"CVE-2022-0778\", \"properties\": [{\"name\": \"detection:method\", \"value\": \"binary_pattern_match\"}, {\"name\": \"detection:confidence\", \"value\": \"high\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/@types/node/crypto.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/@types/node/process.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/@types/node/tls.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/dist/web/ganache.min.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@rushstack/node-core-library/node_modules/@types/node/crypto.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@rushstack/node-core-library/node_modules/@types/node/globals.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@rushstack/node-core-library/node_modules/@types/node/tls.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_arm64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_arm64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_arm64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_x64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_x64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_x64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_x64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_x64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_x64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_win32_x64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_win32_x64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_win32_x64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/dist/uws_linux_x64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/dist/uws_linux_x64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/dist/uws_linux_x64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/node_modules/utf-8-validate/binding.gyp\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/node/crypto.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/node/process.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/node/tls.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/.travis.yml\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/configure.ac\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/build-aux/m4/bitcoin_secp.m4\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/contrib/lax_der_parsing.h\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/src/bench_verify.c\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/src/scalar_4x64_impl.h\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/src/scalar_8x32_impl.h\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/src/tests.c\"}, {\"name\": \"esl:suppression_source\", \"value\": \"cve_exclusions.json\"}, {\"name\": \"esl:earliest_public_at\", \"value\": \"2022-03-15T17:15:08.513000Z\"}, {\"name\": \"esl:earliest_source\", \"value\": \"nvd\"}, {\"name\": \"esl:disclosure_lag_days\", \"value\": \"0\"}, {\"name\": \"esl:response_due_at\", \"value\": \"2022-03-29T17:15:08.513000Z\"}, {\"name\": \"esl:response_status\", \"value\": \"overdue\"}, {\"name\": \"esl:fix_available\", \"value\": \"unknown\"}, {\"name\": \"esl:fix_fixed_versions\", \"value\": \"[]\"}, {\"name\": \"esl:fix_recommended_version\", \"value\": \"\"}, {\"name\": \"esl:fix_recommended_is_major_bump\", \"value\": \"false\"}, {\"name\": \"esl:fix_first_available_at\", \"value\": \"\"}, {\"name\": \"esl:remediation_age_days\", \"value\": \"\"}, {\"name\": \"esl:fix_sources\", \"value\": \"[]\"}, {\"name\": \"esl:fix_reason\", \"value\": \"registry_not_evaluated\"}, {\"name\": \"esl:cve_year\", \"value\": \"2022\"}, {\"name\": \"esl:age_days\", \"value\": \"1649\"}, {\"name\": \"esl:dormant\", \"value\": \"false\"}], \"source\": {\"name\": \"ESL-SBOMator CVE Pattern Detector\", \"url\": \"https://nvd.nist.gov/vuln/detail/CVE-2022-0778\"}}, {\"affects\": [{\"ref\": \"pkg:generic/openssl@0.9.6d\", \"versions\": [{\"status\": \"unknown\", \"version\": \"1.1.1a-1.1.1j\"}]}], \"analysis\": {\"detail\": \"Installed component version is outside the affected range for this CVE (version-aware guard).\", \"justification\": \"code_not_present\", \"state\": \"not_affected\"}, \"esl_kev_analysis\": {\"weaponized\": false}, \"esl_priority\": \"STANDARD\", \"id\": \"CVE-2021-3449\", \"properties\": [{\"name\": \"detection:method\", \"value\": \"binary_pattern_match\"}, {\"name\": \"detection:confidence\", \"value\": \"low\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/@types/node/crypto.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/@types/node/process.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/@types/node/tls.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/dist/web/ganache.min.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@rushstack/node-core-library/node_modules/@types/node/crypto.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@rushstack/node-core-library/node_modules/@types/node/globals.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@rushstack/node-core-library/node_modules/@types/node/tls.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_arm64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_arm64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_arm64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_x64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_x64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_x64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_x64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_x64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_x64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_win32_x64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_win32_x64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_win32_x64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/dist/uws_linux_x64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/dist/uws_linux_x64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/dist/uws_linux_x64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/node_modules/utf-8-validate/binding.gyp\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/node/crypto.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/node/process.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/node/tls.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/.travis.yml\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/configure.ac\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/build-aux/m4/bitcoin_secp.m4\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/contrib/lax_der_parsing.h\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/src/bench_verify.c\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/src/scalar_4x64_impl.h\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/src/scalar_8x32_impl.h\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/src/tests.c\"}, {\"name\": \"esl:suppression_source\", \"value\": \"cve_exclusions.json\"}, {\"name\": \"esl:earliest_public_at\", \"value\": \"2021-03-25T15:15:13.450000Z\"}, {\"name\": \"esl:earliest_source\", \"value\": \"nvd\"}, {\"name\": \"esl:disclosure_lag_days\", \"value\": \"0\"}, {\"name\": \"esl:response_due_at\", \"value\": \"2021-04-08T15:15:13.450000Z\"}, {\"name\": \"esl:response_status\", \"value\": \"not_applicable\"}, {\"name\": \"esl:fix_available\", \"value\": \"unknown\"}, {\"name\": \"esl:fix_fixed_versions\", \"value\": \"[]\"}, {\"name\": \"esl:fix_recommended_version\", \"value\": \"\"}, {\"name\": \"esl:fix_recommended_is_major_bump\", \"value\": \"false\"}, {\"name\": \"esl:fix_first_available_at\", \"value\": \"\"}, {\"name\": \"esl:remediation_age_days\", \"value\": \"\"}, {\"name\": \"esl:fix_sources\", \"value\": \"[]\"}, {\"name\": \"esl:fix_reason\", \"value\": \"registry_not_evaluated\"}, {\"name\": \"esl:cve_year\", \"value\": \"2021\"}, {\"name\": \"esl:age_days\", \"value\": \"2004\"}, {\"name\": \"esl:dormant\", \"value\": \"false\"}], \"source\": {\"name\": \"ESL-SBOMator CVE Pattern Detector\", \"url\": \"https://nvd.nist.gov/vuln/detail/CVE-2021-3449\"}}, {\"affects\": [{\"ref\": \"pkg:generic/openssl@0.9.6d\", \"versions\": [{\"status\": \"unknown\", \"version\": \"1.0.1 to 1.0.1f\"}]}], \"analysis\": {\"detail\": \"Installed component version is outside the affected range for this CVE (version-aware guard).\", \"justification\": \"code_not_present\", \"state\": \"not_affected\"}, \"esl_kev_analysis\": {\"date_added\": \"2022-05-04\", \"due_date\": \"2022-05-25\", \"notes\": \"https://nvd.nist.gov/vuln/detail/CVE-2014-0160\", \"product\": \"OpenSSL\", \"ransomware_use\": false, \"required_action\": \"Apply updates per vendor instructions.\", \"vendor_project\": \"OpenSSL\", \"vulnerability_name\": \"OpenSSL Information Disclosure Vulnerability\", \"weaponized\": true}, \"esl_priority\": \"CRITICAL_WEAPONIZED\", \"id\": \"CVE-2014-0160\", \"properties\": [{\"name\": \"detection:method\", \"value\": \"binary_pattern_match\"}, {\"name\": \"detection:confidence\", \"value\": \"low\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/@types/node/crypto.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/@types/node/process.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/@types/node/tls.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/dist/web/ganache.min.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@rushstack/node-core-library/node_modules/@types/node/crypto.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@rushstack/node-core-library/node_modules/@types/node/globals.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@rushstack/node-core-library/node_modules/@types/node/tls.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_arm64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_arm64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_arm64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_x64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_x64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_x64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_x64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_x64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_x64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_win32_x64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_win32_x64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_win32_x64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/dist/uws_linux_x64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/dist/uws_linux_x64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/dist/uws_linux_x64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/node_modules/utf-8-validate/binding.gyp\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/node/crypto.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/node/process.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/node/tls.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/.travis.yml\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/configure.ac\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/build-aux/m4/bitcoin_secp.m4\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/contrib/lax_der_parsing.h\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/src/bench_verify.c\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/src/scalar_4x64_impl.h\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/src/scalar_8x32_impl.h\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/src/tests.c\"}, {\"name\": \"esl:kev:weaponized\", \"value\": \"true\"}, {\"name\": \"esl:kev:date_added\", \"value\": \"2022-05-04\"}, {\"name\": \"esl:kev:due_date\", \"value\": \"2022-05-25\"}, {\"name\": \"esl:kev:required_action\", \"value\": \"Apply updates per vendor instructions.\"}, {\"name\": \"esl:suppression_source\", \"value\": \"cve_exclusions.json\"}, {\"name\": \"esl:earliest_public_at\", \"value\": \"2014-04-07T22:55:03.893000Z\"}, {\"name\": \"esl:earliest_source\", \"value\": \"nvd\"}, {\"name\": \"esl:disclosure_lag_days\", \"value\": \"0\"}, {\"name\": \"esl:response_due_at\", \"value\": \"2022-05-25T00:00:00Z\"}, {\"name\": \"esl:response_status\", \"value\": \"not_applicable\"}, {\"name\": \"esl:fix_available\", \"value\": \"unknown\"}, {\"name\": \"esl:fix_fixed_versions\", \"value\": \"[]\"}, {\"name\": \"esl:fix_recommended_version\", \"value\": \"\"}, {\"name\": \"esl:fix_recommended_is_major_bump\", \"value\": \"false\"}, {\"name\": \"esl:fix_first_available_at\", \"value\": \"\"}, {\"name\": \"esl:remediation_age_days\", \"value\": \"\"}, {\"name\": \"esl:fix_sources\", \"value\": \"[]\"}, {\"name\": \"esl:fix_reason\", \"value\": \"registry_not_evaluated\"}, {\"name\": \"esl:cve_year\", \"value\": \"2014\"}, {\"name\": \"esl:age_days\", \"value\": \"4548\"}, {\"name\": \"esl:dormant\", \"value\": \"false\"}], \"source\": {\"name\": \"ESL-SBOMator CVE Pattern Detector\", \"url\": \"https://nvd.nist.gov/vuln/detail/CVE-2014-0160\"}}, {\"affects\": [{\"ref\": \"pkg:generic/openssl@0.9.6d\", \"versions\": [{\"status\": \"unknown\", \"version\": \"<1.0.2zg, <1.1.1t, <3.0.8\"}]}], \"analysis\": {\"detail\": \"Installed component version is outside the affected range for this CVE (version-aware guard).\", \"justification\": \"code_not_present\", \"state\": \"not_affected\"}, \"esl_kev_analysis\": {\"weaponized\": false}, \"esl_priority\": \"STANDARD\", \"id\": \"CVE-2023-0286\", \"properties\": [{\"name\": \"detection:method\", \"value\": \"binary_pattern_match\"}, {\"name\": \"detection:confidence\", \"value\": \"medium\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/@types/node/crypto.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/@types/node/process.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/@types/node/tls.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/dist/web/ganache.min.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@rushstack/node-core-library/node_modules/@types/node/crypto.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@rushstack/node-core-library/node_modules/@types/node/globals.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@rushstack/node-core-library/node_modules/@types/node/tls.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_arm64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_arm64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_arm64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_x64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_x64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_x64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_x64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_x64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_x64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_win32_x64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_win32_x64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_win32_x64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/dist/uws_linux_x64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/dist/uws_linux_x64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/dist/uws_linux_x64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/node_modules/utf-8-validate/binding.gyp\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/node/crypto.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/node/process.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/node/tls.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/.travis.yml\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/configure.ac\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/build-aux/m4/bitcoin_secp.m4\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/contrib/lax_der_parsing.h\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/src/bench_verify.c\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/src/scalar_4x64_impl.h\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/src/scalar_8x32_impl.h\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/src/tests.c\"}, {\"name\": \"esl:suppression_source\", \"value\": \"cve_exclusions.json\"}, {\"name\": \"esl:earliest_public_at\", \"value\": \"2023-02-08T20:15:24.267000Z\"}, {\"name\": \"esl:earliest_source\", \"value\": \"nvd\"}, {\"name\": \"esl:disclosure_lag_days\", \"value\": \"0\"}, {\"name\": \"esl:response_due_at\", \"value\": \"2023-02-22T20:15:24.267000Z\"}, {\"name\": \"esl:response_status\", \"value\": \"overdue\"}, {\"name\": \"esl:fix_available\", \"value\": \"unknown\"}, {\"name\": \"esl:fix_fixed_versions\", \"value\": \"[]\"}, {\"name\": \"esl:fix_recommended_version\", \"value\": \"\"}, {\"name\": \"esl:fix_recommended_is_major_bump\", \"value\": \"false\"}, {\"name\": \"esl:fix_first_available_at\", \"value\": \"\"}, {\"name\": \"esl:remediation_age_days\", \"value\": \"\"}, {\"name\": \"esl:fix_sources\", \"value\": \"[]\"}, {\"name\": \"esl:fix_reason\", \"value\": \"registry_not_evaluated\"}, {\"name\": \"esl:cve_year\", \"value\": \"2023\"}, {\"name\": \"esl:age_days\", \"value\": \"1319\"}, {\"name\": \"esl:dormant\", \"value\": \"false\"}], \"source\": {\"name\": \"ESL-SBOMator CVE Pattern Detector\", \"url\": \"https://nvd.nist.gov/vuln/detail/CVE-2023-0286\"}}, {\"affects\": [{\"ref\": \"pkg:generic/openssl@0.9.6d\", \"versions\": [{\"status\": \"unknown\", \"version\": \"<1.0.2x, <1.1.1i\"}]}], \"analysis\": {\"detail\": \"Installed component version is outside the affected range for this CVE (version-aware guard).\", \"justification\": \"code_not_present\", \"state\": \"not_affected\"}, \"esl_kev_analysis\": {\"weaponized\": false}, \"esl_priority\": \"STANDARD\", \"id\": \"CVE-2020-1971\", \"properties\": [{\"name\": \"detection:method\", \"value\": \"binary_pattern_match\"}, {\"name\": \"detection:confidence\", \"value\": \"low\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/@types/node/crypto.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/@types/node/process.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/@types/node/tls.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/dist/web/ganache.min.js.map\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@rushstack/node-core-library/node_modules/@types/node/crypto.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@rushstack/node-core-library/node_modules/@types/node/globals.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@rushstack/node-core-library/node_modules/@types/node/tls.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_arm64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_arm64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_arm64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_x64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_x64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_darwin_x64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_arm_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_x64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_x64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_linux_x64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_win32_x64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_win32_x64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/binaries/uws_win32_x64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/dist/uws_linux_x64_108.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/dist/uws_linux_x64_115.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/dist/uws_linux_x64_93.node\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@trufflesuite/uws-js-unofficial/node_modules/utf-8-validate/binding.gyp\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/node/crypto.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/node/process.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/@types/node/tls.d.ts\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/.travis.yml\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/configure.ac\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/build-aux/m4/bitcoin_secp.m4\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/contrib/lax_der_parsing.h\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/src/bench_verify.c\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/src/scalar_4x64_impl.h\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/src/scalar_8x32_impl.h\"}, {\"name\": \"detection:source_file\", \"value\": \"node_modules/ganache/node_modules/secp256k1/src/secp256k1/src/tests.c\"}, {\"name\": \"esl:suppression_source\", \"value\": \"cve_exclusions.json\"}, {\"name\": \"esl:earliest_public_at\", \"value\": \"2020-12-08T16:15:11.730000Z\"}, {\"name\": \"esl:earliest_source\", \"value\": \"nvd\"}, {\"name\": \"esl:disclosure_lag_days\", \"value\": \"0\"}, {\"name\": \"esl:response_due_at\", \"value\": \"2020-12-22T16:15:11.730000Z\"}, {\"name\": \"esl:response_status\", \"value\": \"overdue\"}, {\"name\": \"esl:fix_available\", \"value\": \"unknown\"}, {\"name\": \"esl:fix_fixed_versions\", \"value\": \"[]\"}, {\"name\": \"esl:fix_recommended_version\", \"value\": \"\"}, {\"name\": \"esl:fix_recommended_is_major_bump\", \"value\": \"false\"}, {\"name\": \"esl:fix_first_available_at\", \"value\": \"\"}, {\"name\": \"esl:remediation_age_days\", \"value\": \"\"}, {\"name\": \"esl:fix_sources\", \"value\": \"[]\"}, {\"name\": \"esl:fix_reason\", \"value\": \"registry_not_evaluated\"}, {\"name\": \"esl:cve_year\", \"value\": \"2020\"}, {\"name\": \"esl:age_days\", \"value\": \"2111\"}, {\"name\": \"esl:dormant\", \"value\": \"false\"}], \"source\": {\"name\": \"ESL-SBOMator CVE Pattern Detector\", \"url\": \"https://nvd.nist.gov/vuln/detail/CVE-2020-1971\"}}]"
      },
      {
        "name": "esl:quality_gate:result",
        "value": "{\"accepted_suppressions\": [], \"blockers\": [], \"configuration_errors\": [], \"first_party_license_exception_count\": 0, \"first_party_version_exception_count\": 0, \"justified_license_exception_count\": 0, \"justified_version_exception_count\": 0, \"policy_file\": null, \"populated_license_count\": 368, \"populated_version_count\": 368, \"schema_version\": 1, \"status\": \"passed\", \"total_components\": 368, \"unresolved_blocker_count\": 0, \"validated_at\": \"2026-09-20T15:33:29+00:00\"}"
      }
    ],
    "manufacture": {
      "name": "E.S.L SOFTWARE LAB LTD"
    }
  },
  "components": [
    {
      "bom-ref": "pkg:npm/@cspotcode/source-map-support@0.8.1",
      "type": "library",
      "name": "@cspotcode/source-map-support",
      "version": "0.8.1",
      "purl": "pkg:npm/@cspotcode/source-map-support@0.8.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@cspotcode\\/source-map-support:\\@cspotcode\\/source_map_support:0.8.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@cspotcode\\/source_map_support:\\@cspotcode\\/source-map-support:0.8.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@cspotcode\\/source_map_support:\\@cspotcode\\/source_map_support:0.8.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@cspotcode\\/source-map:\\@cspotcode\\/source-map-support:0.8.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@cspotcode\\/source-map:\\@cspotcode\\/source_map_support:0.8.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@cspotcode\\/source_map:\\@cspotcode\\/source-map-support:0.8.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@cspotcode\\/source_map:\\@cspotcode\\/source_map_support:0.8.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@cspotcode\\/source:\\@cspotcode\\/source-map-support:0.8.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@cspotcode\\/source:\\@cspotcode\\/source_map_support:0.8.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@cspotcode/source-map-support@0.8.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/@discoveryjs/json-ext@0.5.7",
      "type": "library",
      "name": "@discoveryjs/json-ext",
      "version": "0.5.7",
      "purl": "pkg:npm/@discoveryjs/json-ext@0.5.7",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@discoveryjs\\/json-ext:\\@discoveryjs\\/json_ext:0.5.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@discoveryjs\\/json_ext:\\@discoveryjs\\/json-ext:0.5.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@discoveryjs\\/json_ext:\\@discoveryjs\\/json_ext:0.5.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@discoveryjs\\/json:\\@discoveryjs\\/json-ext:0.5.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@discoveryjs\\/json:\\@discoveryjs\\/json_ext:0.5.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@discoveryjs/json-ext@0.5.7\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40discoveryjs%2Fjson-ext/0.5.7"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@jridgewell/gen-mapping@0.3.2",
      "type": "library",
      "name": "@jridgewell/gen-mapping",
      "version": "0.3.2",
      "purl": "pkg:npm/@jridgewell/gen-mapping@0.3.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/gen-mapping:\\@jridgewell\\/gen_mapping:0.3.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/gen_mapping:\\@jridgewell\\/gen-mapping:0.3.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/gen_mapping:\\@jridgewell\\/gen_mapping:0.3.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/gen:\\@jridgewell\\/gen-mapping:0.3.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/gen:\\@jridgewell\\/gen_mapping:0.3.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@jridgewell/gen-mapping@0.3.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/@jridgewell/resolve-uri@3.1.0",
      "type": "library",
      "name": "@jridgewell/resolve-uri",
      "version": "3.1.0",
      "purl": "pkg:npm/@jridgewell/resolve-uri@3.1.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/resolve-uri:\\@jridgewell\\/resolve_uri:3.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/resolve_uri:\\@jridgewell\\/resolve-uri:3.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/resolve_uri:\\@jridgewell\\/resolve_uri:3.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/resolve:\\@jridgewell\\/resolve-uri:3.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/resolve:\\@jridgewell\\/resolve_uri:3.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@jridgewell/resolve-uri@3.1.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/@jridgewell/set-array@1.1.2",
      "type": "library",
      "name": "@jridgewell/set-array",
      "version": "1.1.2",
      "purl": "pkg:npm/@jridgewell/set-array@1.1.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/set-array:\\@jridgewell\\/set_array:1.1.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/set_array:\\@jridgewell\\/set-array:1.1.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/set_array:\\@jridgewell\\/set_array:1.1.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/set:\\@jridgewell\\/set-array:1.1.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/set:\\@jridgewell\\/set_array:1.1.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@jridgewell/set-array@1.1.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40jridgewell%2Fset-array/1.1.2"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@jridgewell/source-map@0.3.2",
      "type": "library",
      "name": "@jridgewell/source-map",
      "version": "0.3.2",
      "purl": "pkg:npm/@jridgewell/source-map@0.3.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/source-map:\\@jridgewell\\/source_map:0.3.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/source_map:\\@jridgewell\\/source-map:0.3.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/source_map:\\@jridgewell\\/source_map:0.3.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/source:\\@jridgewell\\/source-map:0.3.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/source:\\@jridgewell\\/source_map:0.3.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@jridgewell/source-map@0.3.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/@jridgewell/sourcemap-codec@1.4.14",
      "type": "library",
      "name": "@jridgewell/sourcemap-codec",
      "version": "1.4.14",
      "purl": "pkg:npm/@jridgewell/sourcemap-codec@1.4.14",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/sourcemap-codec:\\@jridgewell\\/sourcemap_codec:1.4.14:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/sourcemap_codec:\\@jridgewell\\/sourcemap-codec:1.4.14:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/sourcemap_codec:\\@jridgewell\\/sourcemap_codec:1.4.14:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/sourcemap:\\@jridgewell\\/sourcemap-codec:1.4.14:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/sourcemap:\\@jridgewell\\/sourcemap_codec:1.4.14:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@jridgewell/sourcemap-codec@1.4.14\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/@jridgewell/trace-mapping@0.3.17",
      "type": "library",
      "name": "@jridgewell/trace-mapping",
      "version": "0.3.17",
      "purl": "pkg:npm/@jridgewell/trace-mapping@0.3.17",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/trace-mapping:\\@jridgewell\\/trace_mapping:0.3.17:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/trace_mapping:\\@jridgewell\\/trace-mapping:0.3.17:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/trace_mapping:\\@jridgewell\\/trace_mapping:0.3.17:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/trace:\\@jridgewell\\/trace-mapping:0.3.17:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/trace:\\@jridgewell\\/trace_mapping:0.3.17:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@jridgewell/trace-mapping@0.3.17\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/@jridgewell/trace-mapping@0.3.9",
      "type": "library",
      "name": "@jridgewell/trace-mapping",
      "version": "0.3.9",
      "purl": "pkg:npm/@jridgewell/trace-mapping@0.3.9",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/trace-mapping:\\@jridgewell\\/trace_mapping:0.3.9:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/trace_mapping:\\@jridgewell\\/trace-mapping:0.3.9:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/trace_mapping:\\@jridgewell\\/trace_mapping:0.3.9:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/trace:\\@jridgewell\\/trace-mapping:0.3.9:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@jridgewell\\/trace:\\@jridgewell\\/trace_mapping:0.3.9:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@jridgewell/trace-mapping@0.3.9\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/@microsoft/api-extractor@7.20.1",
      "type": "library",
      "name": "@microsoft/api-extractor",
      "version": "7.20.1",
      "purl": "pkg:npm/@microsoft/api-extractor@7.20.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@microsoft\\/api-extractor:\\@microsoft\\/api_extractor:7.20.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@microsoft\\/api_extractor:\\@microsoft\\/api-extractor:7.20.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@microsoft\\/api_extractor:\\@microsoft\\/api_extractor:7.20.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@microsoft\\/api:\\@microsoft\\/api-extractor:7.20.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@microsoft\\/api:\\@microsoft\\/api_extractor:7.20.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@microsoft/api-extractor@7.20.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40microsoft%2Fapi-extractor/7.20.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@microsoft/api-extractor-model@7.16.0",
      "type": "library",
      "name": "@microsoft/api-extractor-model",
      "version": "7.16.0",
      "purl": "pkg:npm/@microsoft/api-extractor-model@7.16.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@microsoft\\/api-extractor-model:\\@microsoft\\/api_extractor_model:7.16.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@microsoft\\/api_extractor_model:\\@microsoft\\/api-extractor-model:7.16.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@microsoft\\/api_extractor_model:\\@microsoft\\/api_extractor_model:7.16.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@microsoft\\/api-extractor:\\@microsoft\\/api-extractor-model:7.16.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@microsoft\\/api-extractor:\\@microsoft\\/api_extractor_model:7.16.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@microsoft\\/api_extractor:\\@microsoft\\/api-extractor-model:7.16.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@microsoft\\/api_extractor:\\@microsoft\\/api_extractor_model:7.16.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@microsoft\\/api:\\@microsoft\\/api-extractor-model:7.16.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@microsoft\\/api:\\@microsoft\\/api_extractor_model:7.16.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@microsoft/api-extractor-model@7.16.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40microsoft%2Fapi-extractor-model/7.16.0"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@microsoft/tsdoc@0.13.2",
      "type": "library",
      "name": "@microsoft/tsdoc",
      "version": "0.13.2",
      "purl": "pkg:npm/@microsoft/tsdoc@0.13.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@microsoft/tsdoc@0.13.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40microsoft%2Ftsdoc/0.13.2"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@microsoft/tsdoc-config@0.15.2",
      "type": "library",
      "name": "@microsoft/tsdoc-config",
      "version": "0.15.2",
      "purl": "pkg:npm/@microsoft/tsdoc-config@0.15.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@microsoft\\/tsdoc-config:\\@microsoft\\/tsdoc_config:0.15.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@microsoft\\/tsdoc_config:\\@microsoft\\/tsdoc-config:0.15.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@microsoft\\/tsdoc_config:\\@microsoft\\/tsdoc_config:0.15.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@microsoft\\/tsdoc:\\@microsoft\\/tsdoc-config:0.15.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@microsoft\\/tsdoc:\\@microsoft\\/tsdoc_config:0.15.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@microsoft/tsdoc-config@0.15.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40microsoft%2Ftsdoc-config/0.15.2"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@rushstack/node-core-library@3.45.1",
      "type": "library",
      "name": "@rushstack/node-core-library",
      "version": "3.45.1",
      "purl": "pkg:npm/@rushstack/node-core-library@3.45.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@rushstack\\/node-core-library:\\@rushstack\\/node_core_library:3.45.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@rushstack\\/node_core_library:\\@rushstack\\/node-core-library:3.45.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@rushstack\\/node_core_library:\\@rushstack\\/node_core_library:3.45.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@rushstack\\/node-core:\\@rushstack\\/node-core-library:3.45.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@rushstack\\/node-core:\\@rushstack\\/node_core_library:3.45.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@rushstack\\/node_core:\\@rushstack\\/node-core-library:3.45.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@rushstack\\/node_core:\\@rushstack\\/node_core_library:3.45.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@rushstack\\/node:\\@rushstack\\/node-core-library:3.45.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@rushstack\\/node:\\@rushstack\\/node_core_library:3.45.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@rushstack/node-core-library@3.45.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40rushstack%2Fnode-core-library/3.45.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@rushstack/rig-package@0.3.8",
      "type": "library",
      "name": "@rushstack/rig-package",
      "version": "0.3.8",
      "purl": "pkg:npm/@rushstack/rig-package@0.3.8",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@rushstack\\/rig-package:\\@rushstack\\/rig_package:0.3.8:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@rushstack\\/rig_package:\\@rushstack\\/rig-package:0.3.8:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@rushstack\\/rig_package:\\@rushstack\\/rig_package:0.3.8:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@rushstack\\/rig:\\@rushstack\\/rig-package:0.3.8:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@rushstack\\/rig:\\@rushstack\\/rig_package:0.3.8:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@rushstack/rig-package@0.3.8\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40rushstack%2Frig-package/0.3.8"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@rushstack/ts-command-line@4.10.7",
      "type": "library",
      "name": "@rushstack/ts-command-line",
      "version": "4.10.7",
      "purl": "pkg:npm/@rushstack/ts-command-line@4.10.7",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@rushstack\\/ts-command-line:\\@rushstack\\/ts_command_line:4.10.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@rushstack\\/ts_command_line:\\@rushstack\\/ts-command-line:4.10.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@rushstack\\/ts_command_line:\\@rushstack\\/ts_command_line:4.10.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@rushstack\\/ts-command:\\@rushstack\\/ts-command-line:4.10.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@rushstack\\/ts-command:\\@rushstack\\/ts_command_line:4.10.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@rushstack\\/ts_command:\\@rushstack\\/ts-command-line:4.10.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@rushstack\\/ts_command:\\@rushstack\\/ts_command_line:4.10.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@rushstack\\/ts:\\@rushstack\\/ts-command-line:4.10.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@rushstack\\/ts:\\@rushstack\\/ts_command_line:4.10.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@rushstack/ts-command-line@4.10.7\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40rushstack%2Fts-command-line/4.10.7"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@tsconfig/node10@1.0.9",
      "type": "library",
      "name": "@tsconfig/node10",
      "version": "1.0.9",
      "purl": "pkg:npm/@tsconfig/node10@1.0.9",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@tsconfig/node10@1.0.9\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/@tsconfig/node12@1.0.11",
      "type": "library",
      "name": "@tsconfig/node12",
      "version": "1.0.11",
      "purl": "pkg:npm/@tsconfig/node12@1.0.11",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@tsconfig/node12@1.0.11\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/@tsconfig/node14@1.0.3",
      "type": "library",
      "name": "@tsconfig/node14",
      "version": "1.0.3",
      "purl": "pkg:npm/@tsconfig/node14@1.0.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@tsconfig/node14@1.0.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/@tsconfig/node16@1.0.3",
      "type": "library",
      "name": "@tsconfig/node16",
      "version": "1.0.3",
      "purl": "pkg:npm/@tsconfig/node16@1.0.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@tsconfig/node16@1.0.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/@types/abstract-leveldown@7.2.0",
      "type": "library",
      "name": "@types/abstract-leveldown",
      "version": "7.2.0",
      "purl": "pkg:npm/@types/abstract-leveldown@7.2.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@types\\/abstract-leveldown:\\@types\\/abstract_leveldown:7.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@types\\/abstract_leveldown:\\@types\\/abstract-leveldown:7.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@types\\/abstract_leveldown:\\@types\\/abstract_leveldown:7.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@types\\/abstract:\\@types\\/abstract-leveldown:7.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@types\\/abstract:\\@types\\/abstract_leveldown:7.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@types/abstract-leveldown@7.2.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/@types/argparse@1.0.38",
      "type": "library",
      "name": "@types/argparse",
      "version": "1.0.38",
      "purl": "pkg:npm/@types/argparse@1.0.38",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@types/argparse@1.0.38\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40types%2Fargparse/1.0.38"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@types/eslint@8.4.10",
      "type": "library",
      "name": "@types/eslint",
      "version": "8.4.10",
      "purl": "pkg:npm/@types/eslint@8.4.10",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@types/eslint@8.4.10\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"known_maintainer\", \"supplier\": \"OpenJS Foundation\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40types%2Feslint/8.4.10"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "OpenJS Foundation",
        "url": []
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@types/eslint-scope@3.7.4",
      "type": "library",
      "name": "@types/eslint-scope",
      "version": "3.7.4",
      "purl": "pkg:npm/@types/eslint-scope@3.7.4",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@types\\/eslint-scope:\\@types\\/eslint_scope:3.7.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@types\\/eslint_scope:\\@types\\/eslint-scope:3.7.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@types\\/eslint_scope:\\@types\\/eslint_scope:3.7.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@types\\/eslint:\\@types\\/eslint-scope:3.7.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@types\\/eslint:\\@types\\/eslint_scope:3.7.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@types/eslint-scope@3.7.4\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"library_metadata_db\", \"supplier\": \"DefinitelyTyped Contributors\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40types%2Feslint-scope/3.7.4"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "DefinitelyTyped Contributors",
        "url": []
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@types/estree@0.0.50",
      "type": "library",
      "name": "@types/estree",
      "version": "0.0.50",
      "purl": "pkg:npm/@types/estree@0.0.50",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@types/estree@0.0.50\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/@types/json-schema@7.0.11",
      "type": "library",
      "name": "@types/json-schema",
      "version": "7.0.11",
      "purl": "pkg:npm/@types/json-schema@7.0.11",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@types\\/json-schema:\\@types\\/json_schema:7.0.11:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@types\\/json_schema:\\@types\\/json-schema:7.0.11:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@types\\/json_schema:\\@types\\/json_schema:7.0.11:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@types\\/json:\\@types\\/json-schema:7.0.11:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@types\\/json:\\@types\\/json_schema:7.0.11:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@types/json-schema@7.0.11\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/@types/mocha@9.0.0",
      "type": "library",
      "name": "@types/mocha",
      "version": "9.0.0",
      "purl": "pkg:npm/@types/mocha@9.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@types/mocha@9.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/@types/node@12.20.24",
      "type": "library",
      "name": "@types/node",
      "version": "12.20.24",
      "purl": "pkg:npm/@types/node@12.20.24",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@types/node@12.20.24\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/@ungap/promise-all-settled@1.1.2",
      "type": "library",
      "name": "@ungap/promise-all-settled",
      "version": "1.1.2",
      "purl": "pkg:npm/@ungap/promise-all-settled@1.1.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@ungap\\/promise-all-settled:\\@ungap\\/promise_all_settled:1.1.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@ungap\\/promise_all_settled:\\@ungap\\/promise-all-settled:1.1.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@ungap\\/promise_all_settled:\\@ungap\\/promise_all_settled:1.1.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@ungap\\/promise-all:\\@ungap\\/promise-all-settled:1.1.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@ungap\\/promise-all:\\@ungap\\/promise_all_settled:1.1.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@ungap\\/promise_all:\\@ungap\\/promise-all-settled:1.1.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@ungap\\/promise_all:\\@ungap\\/promise_all_settled:1.1.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@ungap\\/promise:\\@ungap\\/promise-all-settled:1.1.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@ungap\\/promise:\\@ungap\\/promise_all_settled:1.1.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@ungap/promise-all-settled@1.1.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40ungap%2Fpromise-all-settled/1.1.2"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "ISC"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@webassemblyjs/ast@1.11.1",
      "type": "library",
      "name": "@webassemblyjs/ast",
      "version": "1.11.1",
      "purl": "pkg:npm/@webassemblyjs/ast@1.11.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@webassemblyjs/ast@1.11.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40webassemblyjs%2Fast/1.11.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@webassemblyjs/floating-point-hex-parser@1.11.1",
      "type": "library",
      "name": "@webassemblyjs/floating-point-hex-parser",
      "version": "1.11.1",
      "purl": "pkg:npm/@webassemblyjs/floating-point-hex-parser@1.11.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/floating-point-hex-parser:\\@webassemblyjs\\/floating_point_hex_parser:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/floating_point_hex_parser:\\@webassemblyjs\\/floating-point-hex-parser:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/floating_point_hex_parser:\\@webassemblyjs\\/floating_point_hex_parser:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/floating-point-hex:\\@webassemblyjs\\/floating-point-hex-parser:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/floating-point-hex:\\@webassemblyjs\\/floating_point_hex_parser:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/floating_point_hex:\\@webassemblyjs\\/floating-point-hex-parser:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/floating_point_hex:\\@webassemblyjs\\/floating_point_hex_parser:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/floating-point:\\@webassemblyjs\\/floating-point-hex-parser:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/floating-point:\\@webassemblyjs\\/floating_point_hex_parser:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/floating_point:\\@webassemblyjs\\/floating-point-hex-parser:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/floating_point:\\@webassemblyjs\\/floating_point_hex_parser:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/floating:\\@webassemblyjs\\/floating-point-hex-parser:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/floating:\\@webassemblyjs\\/floating_point_hex_parser:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@webassemblyjs/floating-point-hex-parser@1.11.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40webassemblyjs%2Ffloating-point-hex-parser/1.11.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@webassemblyjs/helper-api-error@1.11.1",
      "type": "library",
      "name": "@webassemblyjs/helper-api-error",
      "version": "1.11.1",
      "purl": "pkg:npm/@webassemblyjs/helper-api-error@1.11.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper-api-error:\\@webassemblyjs\\/helper_api_error:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper_api_error:\\@webassemblyjs\\/helper-api-error:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper_api_error:\\@webassemblyjs\\/helper_api_error:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper-api:\\@webassemblyjs\\/helper-api-error:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper-api:\\@webassemblyjs\\/helper_api_error:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper_api:\\@webassemblyjs\\/helper-api-error:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper_api:\\@webassemblyjs\\/helper_api_error:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper:\\@webassemblyjs\\/helper-api-error:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper:\\@webassemblyjs\\/helper_api_error:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@webassemblyjs/helper-api-error@1.11.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40webassemblyjs%2Fhelper-api-error/1.11.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@webassemblyjs/helper-buffer@1.11.1",
      "type": "library",
      "name": "@webassemblyjs/helper-buffer",
      "version": "1.11.1",
      "purl": "pkg:npm/@webassemblyjs/helper-buffer@1.11.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper-buffer:\\@webassemblyjs\\/helper_buffer:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper_buffer:\\@webassemblyjs\\/helper-buffer:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper_buffer:\\@webassemblyjs\\/helper_buffer:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper:\\@webassemblyjs\\/helper-buffer:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper:\\@webassemblyjs\\/helper_buffer:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@webassemblyjs/helper-buffer@1.11.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40webassemblyjs%2Fhelper-buffer/1.11.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@webassemblyjs/helper-numbers@1.11.1",
      "type": "library",
      "name": "@webassemblyjs/helper-numbers",
      "version": "1.11.1",
      "purl": "pkg:npm/@webassemblyjs/helper-numbers@1.11.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper-numbers:\\@webassemblyjs\\/helper_numbers:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper_numbers:\\@webassemblyjs\\/helper-numbers:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper_numbers:\\@webassemblyjs\\/helper_numbers:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper:\\@webassemblyjs\\/helper-numbers:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper:\\@webassemblyjs\\/helper_numbers:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@webassemblyjs/helper-numbers@1.11.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40webassemblyjs%2Fhelper-numbers/1.11.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@webassemblyjs/helper-wasm-bytecode@1.11.1",
      "type": "library",
      "name": "@webassemblyjs/helper-wasm-bytecode",
      "version": "1.11.1",
      "purl": "pkg:npm/@webassemblyjs/helper-wasm-bytecode@1.11.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper-wasm-bytecode:\\@webassemblyjs\\/helper_wasm_bytecode:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper_wasm_bytecode:\\@webassemblyjs\\/helper-wasm-bytecode:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper_wasm_bytecode:\\@webassemblyjs\\/helper_wasm_bytecode:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper-wasm:\\@webassemblyjs\\/helper-wasm-bytecode:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper-wasm:\\@webassemblyjs\\/helper_wasm_bytecode:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper_wasm:\\@webassemblyjs\\/helper-wasm-bytecode:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper_wasm:\\@webassemblyjs\\/helper_wasm_bytecode:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper:\\@webassemblyjs\\/helper-wasm-bytecode:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper:\\@webassemblyjs\\/helper_wasm_bytecode:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@webassemblyjs/helper-wasm-bytecode@1.11.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40webassemblyjs%2Fhelper-wasm-bytecode/1.11.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@webassemblyjs/helper-wasm-section@1.11.1",
      "type": "library",
      "name": "@webassemblyjs/helper-wasm-section",
      "version": "1.11.1",
      "purl": "pkg:npm/@webassemblyjs/helper-wasm-section@1.11.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper-wasm-section:\\@webassemblyjs\\/helper_wasm_section:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper_wasm_section:\\@webassemblyjs\\/helper-wasm-section:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper_wasm_section:\\@webassemblyjs\\/helper_wasm_section:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper-wasm:\\@webassemblyjs\\/helper-wasm-section:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper-wasm:\\@webassemblyjs\\/helper_wasm_section:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper_wasm:\\@webassemblyjs\\/helper-wasm-section:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper_wasm:\\@webassemblyjs\\/helper_wasm_section:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper:\\@webassemblyjs\\/helper-wasm-section:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/helper:\\@webassemblyjs\\/helper_wasm_section:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@webassemblyjs/helper-wasm-section@1.11.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40webassemblyjs%2Fhelper-wasm-section/1.11.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@webassemblyjs/ieee754@1.11.1",
      "type": "library",
      "name": "@webassemblyjs/ieee754",
      "version": "1.11.1",
      "purl": "pkg:npm/@webassemblyjs/ieee754@1.11.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@webassemblyjs/ieee754@1.11.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40webassemblyjs%2Fieee754/1.11.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@webassemblyjs/leb128@1.11.1",
      "type": "library",
      "name": "@webassemblyjs/leb128",
      "version": "1.11.1",
      "purl": "pkg:npm/@webassemblyjs/leb128@1.11.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@webassemblyjs/leb128@1.11.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40webassemblyjs%2Fleb128/1.11.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@webassemblyjs/utf8@1.11.1",
      "type": "library",
      "name": "@webassemblyjs/utf8",
      "version": "1.11.1",
      "purl": "pkg:npm/@webassemblyjs/utf8@1.11.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@webassemblyjs/utf8@1.11.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40webassemblyjs%2Futf8/1.11.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@webassemblyjs/wasm-edit@1.11.1",
      "type": "library",
      "name": "@webassemblyjs/wasm-edit",
      "version": "1.11.1",
      "purl": "pkg:npm/@webassemblyjs/wasm-edit@1.11.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/wasm-edit:\\@webassemblyjs\\/wasm_edit:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/wasm_edit:\\@webassemblyjs\\/wasm-edit:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/wasm_edit:\\@webassemblyjs\\/wasm_edit:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/wasm:\\@webassemblyjs\\/wasm-edit:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/wasm:\\@webassemblyjs\\/wasm_edit:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@webassemblyjs/wasm-edit@1.11.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40webassemblyjs%2Fwasm-edit/1.11.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@webassemblyjs/wasm-gen@1.11.1",
      "type": "library",
      "name": "@webassemblyjs/wasm-gen",
      "version": "1.11.1",
      "purl": "pkg:npm/@webassemblyjs/wasm-gen@1.11.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/wasm-gen:\\@webassemblyjs\\/wasm_gen:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/wasm_gen:\\@webassemblyjs\\/wasm-gen:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/wasm_gen:\\@webassemblyjs\\/wasm_gen:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/wasm:\\@webassemblyjs\\/wasm-gen:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/wasm:\\@webassemblyjs\\/wasm_gen:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@webassemblyjs/wasm-gen@1.11.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40webassemblyjs%2Fwasm-gen/1.11.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@webassemblyjs/wasm-opt@1.11.1",
      "type": "library",
      "name": "@webassemblyjs/wasm-opt",
      "version": "1.11.1",
      "purl": "pkg:npm/@webassemblyjs/wasm-opt@1.11.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/wasm-opt:\\@webassemblyjs\\/wasm_opt:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/wasm_opt:\\@webassemblyjs\\/wasm-opt:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/wasm_opt:\\@webassemblyjs\\/wasm_opt:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/wasm:\\@webassemblyjs\\/wasm-opt:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/wasm:\\@webassemblyjs\\/wasm_opt:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@webassemblyjs/wasm-opt@1.11.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40webassemblyjs%2Fwasm-opt/1.11.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@webassemblyjs/wasm-parser@1.11.1",
      "type": "library",
      "name": "@webassemblyjs/wasm-parser",
      "version": "1.11.1",
      "purl": "pkg:npm/@webassemblyjs/wasm-parser@1.11.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/wasm-parser:\\@webassemblyjs\\/wasm_parser:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/wasm_parser:\\@webassemblyjs\\/wasm-parser:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/wasm_parser:\\@webassemblyjs\\/wasm_parser:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/wasm:\\@webassemblyjs\\/wasm-parser:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/wasm:\\@webassemblyjs\\/wasm_parser:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@webassemblyjs/wasm-parser@1.11.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40webassemblyjs%2Fwasm-parser/1.11.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@webassemblyjs/wast-printer@1.11.1",
      "type": "library",
      "name": "@webassemblyjs/wast-printer",
      "version": "1.11.1",
      "purl": "pkg:npm/@webassemblyjs/wast-printer@1.11.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/wast-printer:\\@webassemblyjs\\/wast_printer:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/wast_printer:\\@webassemblyjs\\/wast-printer:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/wast_printer:\\@webassemblyjs\\/wast_printer:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/wast:\\@webassemblyjs\\/wast-printer:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webassemblyjs\\/wast:\\@webassemblyjs\\/wast_printer:1.11.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@webassemblyjs/wast-printer@1.11.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40webassemblyjs%2Fwast-printer/1.11.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@webpack-cli/configtest@1.2.0",
      "type": "library",
      "name": "@webpack-cli/configtest",
      "version": "1.2.0",
      "purl": "pkg:npm/@webpack-cli/configtest@1.2.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webpack-cli\\/configtest:\\@webpack_cli\\/configtest:1.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webpack_cli\\/configtest:\\@webpack-cli\\/configtest:1.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webpack_cli\\/configtest:\\@webpack_cli\\/configtest:1.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webpack:\\@webpack-cli\\/configtest:1.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webpack:\\@webpack_cli\\/configtest:1.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@webpack-cli/configtest@1.2.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"library_metadata_db\", \"supplier\": \"webpack Contributors\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40webpack-cli%2Fconfigtest/1.2.0"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "webpack Contributors",
        "url": []
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@webpack-cli/info@1.5.0",
      "type": "library",
      "name": "@webpack-cli/info",
      "version": "1.5.0",
      "purl": "pkg:npm/@webpack-cli/info@1.5.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webpack-cli\\/info:\\@webpack_cli\\/info:1.5.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webpack_cli\\/info:\\@webpack-cli\\/info:1.5.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webpack_cli\\/info:\\@webpack_cli\\/info:1.5.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webpack:\\@webpack-cli\\/info:1.5.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webpack:\\@webpack_cli\\/info:1.5.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@webpack-cli/info@1.5.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"library_metadata_db\", \"supplier\": \"webpack Contributors\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40webpack-cli%2Finfo/1.5.0"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "webpack Contributors",
        "url": []
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@webpack-cli/serve@1.7.0",
      "type": "library",
      "name": "@webpack-cli/serve",
      "version": "1.7.0",
      "purl": "pkg:npm/@webpack-cli/serve@1.7.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webpack-cli\\/serve:\\@webpack_cli\\/serve:1.7.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webpack_cli\\/serve:\\@webpack-cli\\/serve:1.7.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webpack_cli\\/serve:\\@webpack_cli\\/serve:1.7.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webpack:\\@webpack-cli\\/serve:1.7.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:\\@webpack:\\@webpack_cli\\/serve:1.7.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@webpack-cli/serve@1.7.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"library_metadata_db\", \"supplier\": \"webpack Contributors\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40webpack-cli%2Fserve/1.7.0"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "webpack Contributors",
        "url": []
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@xtuc/ieee754@1.2.0",
      "type": "library",
      "name": "@xtuc/ieee754",
      "version": "1.2.0",
      "purl": "pkg:npm/@xtuc/ieee754@1.2.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@xtuc/ieee754@1.2.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40xtuc%2Fieee754/1.2.0"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "BSD-3-Clause"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/@xtuc/long@4.2.2",
      "type": "library",
      "name": "@xtuc/long",
      "version": "4.2.2",
      "purl": "pkg:npm/@xtuc/long@4.2.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@xtuc/long@4.2.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40xtuc%2Flong/4.2.2"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/acorn@8.8.1",
      "type": "library",
      "name": "acorn",
      "version": "8.8.1",
      "cpe": "cpe:2.3:a:acorn:acorn:8.8.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/acorn@8.8.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/acorn@8.8.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"marijn\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "marijn",
        "url": [
          "https://github.com/acornjs/acorn"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/acorn-import-assertions@1.8.0",
      "type": "library",
      "name": "acorn-import-assertions",
      "version": "1.8.0",
      "cpe": "cpe:2.3:a:acorn-import-assertions:acorn-import-assertions:1.8.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/acorn-import-assertions@1.8.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:acorn-import-assertions:acorn_import_assertions:1.8.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:acorn_import_assertions:acorn-import-assertions:1.8.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:acorn_import_assertions:acorn_import_assertions:1.8.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:acorn-import:acorn-import-assertions:1.8.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:acorn-import:acorn_import_assertions:1.8.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:acorn_import:acorn-import-assertions:1.8.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:acorn_import:acorn_import_assertions:1.8.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:acorn:acorn-import-assertions:1.8.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:acorn:acorn_import_assertions:1.8.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/acorn-import-assertions@1.8.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/acorn-import-assertions/1.8.0"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/acorn-walk@8.2.0",
      "type": "library",
      "name": "acorn-walk",
      "version": "8.2.0",
      "cpe": "cpe:2.3:a:acorn-walk:acorn-walk:8.2.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/acorn-walk@8.2.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:acorn-walk:acorn_walk:8.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:acorn_walk:acorn-walk:8.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:acorn_walk:acorn_walk:8.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:acorn:acorn-walk:8.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:acorn:acorn_walk:8.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/acorn-walk@8.2.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/ajv@6.12.6",
      "type": "library",
      "name": "ajv",
      "version": "6.12.6",
      "cpe": "cpe:2.3:a:ajv:ajv:6.12.6:*:*:*:*:*:*:*",
      "purl": "pkg:npm/ajv@6.12.6",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/ajv@6.12.6\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Evgeny Poberezkin\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Evgeny Poberezkin",
        "url": [
          "https://ajv.js.org"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/ajv-keywords@3.5.2",
      "type": "library",
      "name": "ajv-keywords",
      "version": "3.5.2",
      "cpe": "cpe:2.3:a:ajv-keywords:ajv-keywords:3.5.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/ajv-keywords@3.5.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:ajv-keywords:ajv_keywords:3.5.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:ajv_keywords:ajv-keywords:3.5.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:ajv_keywords:ajv_keywords:3.5.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:ajv:ajv-keywords:3.5.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:ajv:ajv_keywords:3.5.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/ajv-keywords@3.5.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/ansi-colors@4.1.1",
      "type": "library",
      "name": "ansi-colors",
      "version": "4.1.1",
      "cpe": "cpe:2.3:a:ansi-colors:ansi-colors:4.1.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/ansi-colors@4.1.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:ansi-colors:ansi_colors:4.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:ansi_colors:ansi-colors:4.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:ansi_colors:ansi_colors:4.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:ansi:ansi-colors:4.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:ansi:ansi_colors:4.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/ansi-colors@4.1.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/ansi-regex@5.0.1",
      "type": "library",
      "name": "ansi-regex",
      "version": "5.0.1",
      "cpe": "cpe:2.3:a:ansi-regex_project:ansi-regex:5.0.1:*:*:*:*:node.js:*:*",
      "purl": "pkg:npm/ansi-regex@5.0.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/ansi-regex@5.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}, {\"code\": \"malicious_version\", \"message\": \"Known malicious package name (all versions): OSV malicious-package record MAL-2025-46966 (source: osv_mal)\", \"severity\": \"Critical\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "malicious_version"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Sindre Sorhus\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Sindre Sorhus",
        "url": [
          "https://github.com/chalk/ansi-regex#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/ansi-styles@4.3.0",
      "type": "library",
      "name": "ansi-styles",
      "version": "4.3.0",
      "cpe": "cpe:2.3:a:ansi-styles:ansi-styles:4.3.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/ansi-styles@4.3.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:ansi-styles:ansi_styles:4.3.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:ansi_styles:ansi-styles:4.3.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:ansi_styles:ansi_styles:4.3.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:ansi:ansi-styles:4.3.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:ansi:ansi_styles:4.3.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/ansi-styles@4.3.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}, {\"code\": \"malicious_version\", \"message\": \"Known malicious package name (all versions): OSV malicious-package record MAL-2025-46967 (source: osv_mal)\", \"severity\": \"Critical\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "malicious_version"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Sindre Sorhus\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Sindre Sorhus",
        "url": [
          "https://github.com/chalk/ansi-styles#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/anymatch@3.1.3",
      "type": "library",
      "name": "anymatch",
      "version": "3.1.3",
      "cpe": "cpe:2.3:a:anymatch:anymatch:3.1.3:*:*:*:*:*:*:*",
      "purl": "pkg:npm/anymatch@3.1.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/anymatch@3.1.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://spdx.org/licenses/ISC.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/arg@4.1.3",
      "type": "library",
      "name": "arg",
      "version": "4.1.3",
      "cpe": "cpe:2.3:a:arg:arg:4.1.3:*:*:*:*:*:*:*",
      "purl": "pkg:npm/arg@4.1.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/arg@4.1.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/argparse@1.0.10",
      "type": "library",
      "name": "argparse",
      "version": "1.0.10",
      "cpe": "cpe:2.3:a:argparse:argparse:1.0.10:*:*:*:*:*:*:*",
      "purl": "pkg:npm/argparse@1.0.10",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/argparse@1.0.10\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"vitaly\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "vitaly",
        "url": [
          "https://github.com/nodeca/argparse#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/argparse@2.0.1",
      "type": "library",
      "name": "argparse",
      "version": "2.0.1",
      "cpe": "cpe:2.3:a:argparse:argparse:2.0.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/argparse@2.0.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/argparse@2.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"vitaly\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "vitaly",
        "url": [
          "https://github.com/nodeca/argparse#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "name": "Python-2.0"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/asn1.js@5.4.1",
      "type": "library",
      "name": "asn1.js",
      "version": "5.4.1",
      "cpe": "cpe:2.3:a:asn1.js:asn1.js:5.4.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/asn1.js@5.4.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/asn1.js@5.4.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/assert@2.0.0",
      "type": "library",
      "name": "assert",
      "version": "2.0.0",
      "cpe": "cpe:2.3:a:assert:assert:2.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/assert@2.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/assert@2.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/available-typed-arrays@1.0.5",
      "type": "library",
      "name": "available-typed-arrays",
      "version": "1.0.5",
      "cpe": "cpe:2.3:a:available-typed-arrays:available-typed-arrays:1.0.5:*:*:*:*:*:*:*",
      "purl": "pkg:npm/available-typed-arrays@1.0.5",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:available-typed-arrays:available_typed_arrays:1.0.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:available_typed_arrays:available-typed-arrays:1.0.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:available_typed_arrays:available_typed_arrays:1.0.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:available-typed:available-typed-arrays:1.0.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:available-typed:available_typed_arrays:1.0.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:available_typed:available-typed-arrays:1.0.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:available_typed:available_typed_arrays:1.0.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:available:available-typed-arrays:1.0.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:available:available_typed_arrays:1.0.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/available-typed-arrays@1.0.5\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/balanced-match@1.0.2",
      "type": "library",
      "name": "balanced-match",
      "version": "1.0.2",
      "cpe": "cpe:2.3:a:balanced-match:balanced-match:1.0.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/balanced-match@1.0.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:balanced-match:balanced_match:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:balanced_match:balanced-match:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:balanced_match:balanced_match:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:balanced:balanced-match:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:balanced:balanced_match:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/balanced-match@1.0.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"juliangruber\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "juliangruber",
        "url": [
          "https://github.com/juliangruber/balanced-match#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/big.js@5.2.2",
      "type": "library",
      "name": "big.js",
      "version": "5.2.2",
      "cpe": "cpe:2.3:a:big.js:big.js:5.2.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/big.js@5.2.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/big.js@5.2.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/binary-extensions@2.2.0",
      "type": "library",
      "name": "binary-extensions",
      "version": "2.2.0",
      "cpe": "cpe:2.3:a:binary-extensions:binary-extensions:2.2.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/binary-extensions@2.2.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:binary-extensions:binary_extensions:2.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:binary_extensions:binary-extensions:2.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:binary_extensions:binary_extensions:2.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:binary:binary-extensions:2.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:binary:binary_extensions:2.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/binary-extensions@2.2.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/bn.js@4.12.0",
      "type": "library",
      "name": "bn.js",
      "version": "4.12.0",
      "cpe": "cpe:2.3:a:bn.js:bn.js:4.12.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/bn.js@4.12.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft, cdxgen"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.9"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/bn.js@4.12.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "matched"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "CVE(s) matched by configured CVE sources"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:component:osv_scan_info",
          "value": "{\"ecosystem\": \"npm\", \"scan_timestamp\": \"2026-09-20T13:19:52.033707\", \"scanner\": \"local_osv\", \"vulnerability_count\": 1}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.9,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              },
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/bn.js@5.2.1",
      "type": "library",
      "name": "bn.js",
      "version": "5.2.1",
      "cpe": "cpe:2.3:a:bn.js:bn.js:5.2.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/bn.js@5.2.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/bn.js@5.2.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "matched"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "CVE(s) matched by configured CVE sources"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:component:osv_scan_info",
          "value": "{\"ecosystem\": \"npm\", \"scan_timestamp\": \"2026-09-20T13:19:52.083969\", \"scanner\": \"local_osv\", \"vulnerability_count\": 1}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/brace-expansion@1.1.11",
      "type": "library",
      "name": "brace-expansion",
      "version": "1.1.11",
      "cpe": "cpe:2.3:a:brace-expansion:brace-expansion:1.1.11:*:*:*:*:*:*:*",
      "purl": "pkg:npm/brace-expansion@1.1.11",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:brace-expansion:brace_expansion:1.1.11:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:brace_expansion:brace-expansion:1.1.11:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:brace_expansion:brace_expansion:1.1.11:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:brace:brace-expansion:1.1.11:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:brace:brace_expansion:1.1.11:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/brace-expansion@1.1.11\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"juliangruber\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "juliangruber",
        "url": [
          "https://github.com/juliangruber/brace-expansion#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/braces@3.0.2",
      "type": "library",
      "name": "braces",
      "version": "3.0.2",
      "cpe": "cpe:2.3:a:braces_project:braces:3.0.2:*:*:*:*:node.js:*:*",
      "purl": "pkg:npm/braces@3.0.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/braces@3.0.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"known_maintainer\", \"supplier\": \"Jon Schlinkert\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Jon Schlinkert",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/browser-stdout@1.3.1",
      "type": "library",
      "name": "browser-stdout",
      "version": "1.3.1",
      "cpe": "cpe:2.3:a:browser-stdout:browser-stdout:1.3.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/browser-stdout@1.3.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:browser-stdout:browser_stdout:1.3.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:browser_stdout:browser-stdout:1.3.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:browser_stdout:browser_stdout:1.3.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:browser:browser-stdout:1.3.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:browser:browser_stdout:1.3.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/browser-stdout@1.3.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://spdx.org/licenses/ISC.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/browserify-aes@1.2.0",
      "type": "library",
      "name": "browserify-aes",
      "version": "1.2.0",
      "cpe": "cpe:2.3:a:browserify-aes:browserify-aes:1.2.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/browserify-aes@1.2.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:browserify-aes:browserify_aes:1.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:browserify_aes:browserify-aes:1.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:browserify_aes:browserify_aes:1.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:browserify:browserify-aes:1.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:browserify:browserify_aes:1.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/browserify-aes@1.2.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/browserify-cipher@1.0.1",
      "type": "library",
      "name": "browserify-cipher",
      "version": "1.0.1",
      "cpe": "cpe:2.3:a:browserify-cipher:browserify-cipher:1.0.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/browserify-cipher@1.0.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:browserify-cipher:browserify_cipher:1.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:browserify_cipher:browserify-cipher:1.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:browserify_cipher:browserify_cipher:1.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:browserify:browserify-cipher:1.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:browserify:browserify_cipher:1.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/browserify-cipher@1.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/browserify-des@1.0.2",
      "type": "library",
      "name": "browserify-des",
      "version": "1.0.2",
      "cpe": "cpe:2.3:a:browserify-des:browserify-des:1.0.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/browserify-des@1.0.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:browserify-des:browserify_des:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:browserify_des:browserify-des:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:browserify_des:browserify_des:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:browserify:browserify-des:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:browserify:browserify_des:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/browserify-des@1.0.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/browserify-rsa@4.1.0",
      "type": "library",
      "name": "browserify-rsa",
      "version": "4.1.0",
      "cpe": "cpe:2.3:a:browserify-rsa:browserify-rsa:4.1.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/browserify-rsa@4.1.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:browserify-rsa:browserify_rsa:4.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:browserify_rsa:browserify-rsa:4.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:browserify_rsa:browserify_rsa:4.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:browserify:browserify-rsa:4.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:browserify:browserify_rsa:4.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/browserify-rsa@4.1.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/browserify-sign@4.2.1",
      "type": "library",
      "name": "browserify-sign",
      "version": "4.2.1",
      "cpe": "cpe:2.3:a:browserify:browserify-sign:4.2.1:*:*:*:*:node.js:*:*",
      "purl": "pkg:npm/browserify-sign@4.2.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/browserify-sign@4.2.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://spdx.org/licenses/ISC.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/browserslist@4.21.4",
      "type": "library",
      "name": "browserslist",
      "version": "4.21.4",
      "cpe": "cpe:2.3:a:browserslist_project:browserslist:4.21.4:*:*:*:*:node.js:*:*",
      "purl": "pkg:npm/browserslist@4.21.4",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/browserslist@4.21.4\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/buffer-from@1.1.2",
      "type": "library",
      "name": "buffer-from",
      "version": "1.1.2",
      "cpe": "cpe:2.3:a:buffer-from:buffer-from:1.1.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/buffer-from@1.1.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:buffer-from:buffer_from:1.1.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:buffer_from:buffer-from:1.1.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:buffer_from:buffer_from:1.1.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:buffer:buffer-from:1.1.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:buffer:buffer_from:1.1.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/buffer-from@1.1.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/buffer-xor@1.0.3",
      "type": "library",
      "name": "buffer-xor",
      "version": "1.0.3",
      "cpe": "cpe:2.3:a:buffer-xor:buffer-xor:1.0.3:*:*:*:*:*:*:*",
      "purl": "pkg:npm/buffer-xor@1.0.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:buffer-xor:buffer_xor:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:buffer_xor:buffer-xor:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:buffer_xor:buffer_xor:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:buffer:buffer-xor:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:buffer:buffer_xor:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/buffer-xor@1.0.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/builtin-status-codes@3.0.0",
      "type": "library",
      "name": "builtin-status-codes",
      "version": "3.0.0",
      "cpe": "cpe:2.3:a:builtin-status-codes:builtin-status-codes:3.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/builtin-status-codes@3.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:builtin-status-codes:builtin_status_codes:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:builtin_status_codes:builtin-status-codes:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:builtin_status_codes:builtin_status_codes:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:builtin-status:builtin-status-codes:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:builtin-status:builtin_status_codes:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:builtin_status:builtin-status-codes:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:builtin_status:builtin_status_codes:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:builtin:builtin-status-codes:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:builtin:builtin_status_codes:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/builtin-status-codes@3.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/call-bind@1.0.2",
      "type": "library",
      "name": "call-bind",
      "version": "1.0.2",
      "cpe": "cpe:2.3:a:call-bind:call-bind:1.0.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/call-bind@1.0.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:call-bind:call_bind:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:call_bind:call-bind:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:call_bind:call_bind:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:call:call-bind:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:call:call_bind:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/call-bind@1.0.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/camelcase@6.3.0",
      "type": "library",
      "name": "camelcase",
      "version": "6.3.0",
      "cpe": "cpe:2.3:a:camelcase:camelcase:6.3.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/camelcase@6.3.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/camelcase@6.3.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/caniuse-lite@1.0.30001435",
      "type": "library",
      "name": "caniuse-lite",
      "version": "1.0.30001435",
      "cpe": "cpe:2.3:a:caniuse-lite:caniuse-lite:1.0.30001435:*:*:*:*:*:*:*",
      "purl": "pkg:npm/caniuse-lite@1.0.30001435",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:caniuse-lite:caniuse_lite:1.0.30001435:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:caniuse_lite:caniuse-lite:1.0.30001435:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:caniuse_lite:caniuse_lite:1.0.30001435:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:caniuse:caniuse-lite:1.0.30001435:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:caniuse:caniuse_lite:1.0.30001435:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/caniuse-lite@1.0.30001435\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "name": "CC-BY-4.0"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/chalk@4.1.2",
      "type": "library",
      "name": "chalk",
      "version": "4.1.2",
      "cpe": "cpe:2.3:a:chalk:chalk:4.1.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/chalk@4.1.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/chalk@4.1.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}, {\"code\": \"malicious_version\", \"message\": \"Known malicious package name (all versions): OSV malicious-package record MAL-2025-46969 (source: osv_mal)\", \"severity\": \"Critical\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "malicious_version"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"known_maintainer\", \"supplier\": \"Sindre Sorhus\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Sindre Sorhus",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/chokidar@3.5.2",
      "type": "library",
      "name": "chokidar",
      "version": "3.5.2",
      "cpe": "cpe:2.3:a:chokidar:chokidar:3.5.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/chokidar@3.5.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/chokidar@3.5.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/chrome-trace-event@1.0.3",
      "type": "library",
      "name": "chrome-trace-event",
      "version": "1.0.3",
      "cpe": "cpe:2.3:a:chrome-trace-event:chrome-trace-event:1.0.3:*:*:*:*:*:*:*",
      "purl": "pkg:npm/chrome-trace-event@1.0.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:chrome-trace-event:chrome_trace_event:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:chrome_trace_event:chrome-trace-event:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:chrome_trace_event:chrome_trace_event:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:chrome-trace:chrome-trace-event:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:chrome-trace:chrome_trace_event:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:chrome_trace:chrome-trace-event:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:chrome_trace:chrome_trace_event:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:chrome:chrome-trace-event:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:chrome:chrome_trace_event:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/chrome-trace-event@1.0.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/chrome-trace-event/1.0.3"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/cipher-base@1.0.4",
      "type": "library",
      "name": "cipher-base",
      "version": "1.0.4",
      "cpe": "cpe:2.3:a:cipher-base:cipher-base:1.0.4:*:*:*:*:*:*:*",
      "purl": "pkg:npm/cipher-base@1.0.4",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:cipher-base:cipher_base:1.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:cipher_base:cipher-base:1.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:cipher_base:cipher_base:1.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:cipher:cipher-base:1.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:cipher:cipher_base:1.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/cipher-base@1.0.4\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/cliui@7.0.4",
      "type": "library",
      "name": "cliui",
      "version": "7.0.4",
      "cpe": "cpe:2.3:a:cliui:cliui:7.0.4:*:*:*:*:*:*:*",
      "purl": "pkg:npm/cliui@7.0.4",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/cliui@7.0.4\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://spdx.org/licenses/ISC.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/clone-deep@4.0.1",
      "type": "library",
      "name": "clone-deep",
      "version": "4.0.1",
      "cpe": "cpe:2.3:a:clone-deep:clone-deep:4.0.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/clone-deep@4.0.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:clone-deep:clone_deep:4.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:clone_deep:clone-deep:4.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:clone_deep:clone_deep:4.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:clone:clone-deep:4.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:clone:clone_deep:4.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/clone-deep@4.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/clone-deep/4.0.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/color-convert@2.0.1",
      "type": "library",
      "name": "color-convert",
      "version": "2.0.1",
      "cpe": "cpe:2.3:a:color-convert:color-convert:2.0.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/color-convert@2.0.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:color-convert:color_convert:2.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:color_convert:color-convert:2.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:color_convert:color_convert:2.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:color:color-convert:2.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:color:color_convert:2.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/color-convert@2.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}, {\"code\": \"malicious_version\", \"message\": \"Known malicious package name (all versions): OSV malicious-package record MAL-2025-46971 (source: osv_mal)\", \"severity\": \"Critical\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "malicious_version"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Josh Junon\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Josh Junon",
        "url": [
          "https://github.com/Qix-/color-convert#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/color-name@1.1.4",
      "type": "library",
      "name": "color-name",
      "version": "1.1.4",
      "cpe": "cpe:2.3:a:color-name:color-name:1.1.4:*:*:*:*:*:*:*",
      "purl": "pkg:npm/color-name@1.1.4",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:color-name:color_name:1.1.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:color_name:color-name:1.1.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:color_name:color_name:1.1.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:color:color-name:1.1.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:color:color_name:1.1.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/color-name@1.1.4\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}, {\"code\": \"malicious_version\", \"message\": \"Known malicious package name (all versions): OSV malicious-package record MAL-2025-46972 (source: osv_mal)\", \"severity\": \"Critical\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "malicious_version"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Dmitry Iv\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Dmitry Iv",
        "url": [
          "https://github.com/colorjs/color-name"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/colorette@2.0.19",
      "type": "library",
      "name": "colorette",
      "version": "2.0.19",
      "cpe": "cpe:2.3:a:colorette:colorette:2.0.19:*:*:*:*:*:*:*",
      "purl": "pkg:npm/colorette@2.0.19",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/colorette@2.0.19\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/colorette/2.0.19"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/colors@1.2.5",
      "type": "library",
      "name": "colors",
      "version": "1.2.5",
      "cpe": "cpe:2.3:a:colors:colors:1.2.5:*:*:*:*:*:*:*",
      "purl": "pkg:npm/colors@1.2.5",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/colors@1.2.5\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/commander@2.20.3",
      "type": "library",
      "name": "commander",
      "version": "2.20.3",
      "cpe": "cpe:2.3:a:commander:commander:2.20.3:*:*:*:*:*:*:*",
      "purl": "pkg:npm/commander@2.20.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft, cdxgen"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.9"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/commander@2.20.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"known_maintainer\", \"supplier\": \"TJ Holowaychuk\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "TJ Holowaychuk",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.9,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              },
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/commander@7.2.0",
      "type": "library",
      "name": "commander",
      "version": "7.2.0",
      "cpe": "cpe:2.3:a:commander:commander:7.2.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/commander@7.2.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/commander@7.2.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"known_maintainer\", \"supplier\": \"TJ Holowaychuk\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "TJ Holowaychuk",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/concat-map@0.0.1",
      "type": "library",
      "name": "concat-map",
      "version": "0.0.1",
      "cpe": "cpe:2.3:a:concat-map:concat-map:0.0.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/concat-map@0.0.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:concat-map:concat_map:0.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:concat_map:concat-map:0.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:concat_map:concat_map:0.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:concat:concat-map:0.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:concat:concat_map:0.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/concat-map@0.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"James Halliday\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "James Halliday",
        "url": [
          "https://github.com/ljharb/concat-map#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/create-ecdh@4.0.4",
      "type": "library",
      "name": "create-ecdh",
      "version": "4.0.4",
      "cpe": "cpe:2.3:a:create-ecdh:create-ecdh:4.0.4:*:*:*:*:*:*:*",
      "purl": "pkg:npm/create-ecdh@4.0.4",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:create-ecdh:create_ecdh:4.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:create_ecdh:create-ecdh:4.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:create_ecdh:create_ecdh:4.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:create:create-ecdh:4.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:create:create_ecdh:4.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/create-ecdh@4.0.4\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/create-hash@1.2.0",
      "type": "library",
      "name": "create-hash",
      "version": "1.2.0",
      "cpe": "cpe:2.3:a:create-hash:create-hash:1.2.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/create-hash@1.2.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:create-hash:create_hash:1.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:create_hash:create-hash:1.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:create_hash:create_hash:1.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:create:create-hash:1.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:create:create_hash:1.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/create-hash@1.2.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/create-hmac@1.1.7",
      "type": "library",
      "name": "create-hmac",
      "version": "1.1.7",
      "cpe": "cpe:2.3:a:create-hmac:create-hmac:1.1.7:*:*:*:*:*:*:*",
      "purl": "pkg:npm/create-hmac@1.1.7",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:create-hmac:create_hmac:1.1.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:create_hmac:create-hmac:1.1.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:create_hmac:create_hmac:1.1.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:create:create-hmac:1.1.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:create:create_hmac:1.1.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/create-hmac@1.1.7\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/create-require@1.1.1",
      "type": "library",
      "name": "create-require",
      "version": "1.1.1",
      "cpe": "cpe:2.3:a:create-require:create-require:1.1.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/create-require@1.1.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:create-require:create_require:1.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:create_require:create-require:1.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:create_require:create_require:1.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:create:create-require:1.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:create:create_require:1.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/create-require@1.1.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/cross-env@7.0.3",
      "type": "library",
      "name": "cross-env",
      "version": "7.0.3",
      "cpe": "cpe:2.3:a:cross-env:cross-env:7.0.3:*:*:*:*:*:*:*",
      "purl": "pkg:npm/cross-env@7.0.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:cross-env:cross_env:7.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:cross_env:cross-env:7.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:cross_env:cross_env:7.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:cross:cross-env:7.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:cross:cross_env:7.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/cross-env@7.0.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"known_maintainer\", \"supplier\": \"Kent C. Dodds\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/cross-env/7.0.3"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Kent C. Dodds",
        "url": []
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/cross-spawn@7.0.3",
      "type": "library",
      "name": "cross-spawn",
      "version": "7.0.3",
      "cpe": "cpe:2.3:a:cross-spawn:cross-spawn:7.0.3:*:*:*:*:*:*:*",
      "purl": "pkg:npm/cross-spawn@7.0.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:cross-spawn:cross_spawn:7.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:cross_spawn:cross-spawn:7.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:cross_spawn:cross_spawn:7.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:cross:cross-spawn:7.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:cross:cross_spawn:7.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/cross-spawn@7.0.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"André Cruz\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "André Cruz",
        "url": [
          "https://github.com/moxystudio/node-cross-spawn"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/crypto-browserify@3.12.0",
      "type": "library",
      "name": "crypto-browserify",
      "version": "3.12.0",
      "cpe": "cpe:2.3:a:crypto-browserify:crypto-browserify:3.12.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/crypto-browserify@3.12.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:crypto-browserify:crypto_browserify:3.12.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:crypto_browserify:crypto-browserify:3.12.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:crypto_browserify:crypto_browserify:3.12.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:crypto:crypto-browserify:3.12.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:crypto:crypto_browserify:3.12.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/crypto-browserify@3.12.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/debug@4.3.2",
      "type": "library",
      "name": "debug",
      "version": "4.3.2",
      "cpe": "cpe:2.3:a:debug_project:debug:4.3.2:*:*:*:*:node.js:*:*",
      "purl": "pkg:npm/debug@4.3.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/debug@4.3.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}, {\"code\": \"malicious_version\", \"message\": \"Known malicious package name (all versions): OSV malicious-package record MAL-2025-46974 (source: osv_mal)\", \"severity\": \"Critical\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "malicious_version"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"known_maintainer\", \"supplier\": \"TJ Holowaychuk\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "TJ Holowaychuk",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/decamelize@4.0.0",
      "type": "library",
      "name": "decamelize",
      "version": "4.0.0",
      "cpe": "cpe:2.3:a:decamelize:decamelize:4.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/decamelize@4.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/decamelize@4.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/define-properties@1.1.4",
      "type": "library",
      "name": "define-properties",
      "version": "1.1.4",
      "cpe": "cpe:2.3:a:define-properties:define-properties:1.1.4:*:*:*:*:*:*:*",
      "purl": "pkg:npm/define-properties@1.1.4",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:define-properties:define_properties:1.1.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:define_properties:define-properties:1.1.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:define_properties:define_properties:1.1.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:define:define-properties:1.1.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:define:define_properties:1.1.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/define-properties@1.1.4\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/des.js@1.0.1",
      "type": "library",
      "name": "des.js",
      "version": "1.0.1",
      "cpe": "cpe:2.3:a:des.js:des.js:1.0.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/des.js@1.0.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/des.js@1.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/diff@4.0.2",
      "type": "library",
      "name": "diff",
      "version": "4.0.2",
      "cpe": "cpe:2.3:a:diff:diff:4.0.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/diff@4.0.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/diff@4.0.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "BSD-3-Clause",
            "url": "https://spdx.org/licenses/BSD-3-Clause.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/diff@5.0.0",
      "type": "library",
      "name": "diff",
      "version": "5.0.0",
      "cpe": "cpe:2.3:a:diff:diff:5.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/diff@5.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/diff@5.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "BSD-3-Clause",
            "url": "https://spdx.org/licenses/BSD-3-Clause.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/diffie-hellman@5.0.3",
      "type": "library",
      "name": "diffie-hellman",
      "version": "5.0.3",
      "cpe": "cpe:2.3:a:diffie-hellman:diffie-hellman:5.0.3:*:*:*:*:*:*:*",
      "purl": "pkg:npm/diffie-hellman@5.0.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:diffie-hellman:diffie_hellman:5.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:diffie_hellman:diffie-hellman:5.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:diffie_hellman:diffie_hellman:5.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:diffie:diffie-hellman:5.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:diffie:diffie_hellman:5.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/diffie-hellman@5.0.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/electron-to-chromium@1.4.284",
      "type": "library",
      "name": "electron-to-chromium",
      "version": "1.4.284",
      "cpe": "cpe:2.3:a:electron-to-chromium:electron-to-chromium:1.4.284:*:*:*:*:*:*:*",
      "purl": "pkg:npm/electron-to-chromium@1.4.284",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:electron-to-chromium:electron_to_chromium:1.4.284:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:electron_to_chromium:electron-to-chromium:1.4.284:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:electron_to_chromium:electron_to_chromium:1.4.284:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:electron-to:electron-to-chromium:1.4.284:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:electron-to:electron_to_chromium:1.4.284:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:electron_to:electron-to-chromium:1.4.284:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:electron_to:electron_to_chromium:1.4.284:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:electron:electron-to-chromium:1.4.284:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:electron:electron_to_chromium:1.4.284:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/electron-to-chromium@1.4.284\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://spdx.org/licenses/ISC.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/emoji-regex@8.0.0",
      "type": "library",
      "name": "emoji-regex",
      "version": "8.0.0",
      "cpe": "cpe:2.3:a:emoji-regex:emoji-regex:8.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/emoji-regex@8.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:emoji-regex:emoji_regex:8.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:emoji_regex:emoji-regex:8.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:emoji_regex:emoji_regex:8.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:emoji:emoji-regex:8.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:emoji:emoji_regex:8.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/emoji-regex@8.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Unknown",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/emojis-list@3.0.0",
      "type": "library",
      "name": "emojis-list",
      "version": "3.0.0",
      "cpe": "cpe:2.3:a:emojis-list:emojis-list:3.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/emojis-list@3.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:emojis-list:emojis_list:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:emojis_list:emojis-list:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:emojis_list:emojis_list:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:emojis:emojis-list:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:emojis:emojis_list:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/emojis-list@3.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/enhanced-resolve@5.12.0",
      "type": "library",
      "name": "enhanced-resolve",
      "version": "5.12.0",
      "cpe": "cpe:2.3:a:enhanced-resolve:enhanced-resolve:5.12.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/enhanced-resolve@5.12.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:enhanced-resolve:enhanced_resolve:5.12.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:enhanced_resolve:enhanced-resolve:5.12.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:enhanced_resolve:enhanced_resolve:5.12.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:enhanced:enhanced-resolve:5.12.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:enhanced:enhanced_resolve:5.12.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/enhanced-resolve@5.12.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/envinfo@7.8.1",
      "type": "library",
      "name": "envinfo",
      "version": "7.8.1",
      "cpe": "cpe:2.3:a:envinfo:envinfo:7.8.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/envinfo@7.8.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/envinfo@7.8.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/envinfo/7.8.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/es-module-lexer@0.9.3",
      "type": "library",
      "name": "es-module-lexer",
      "version": "0.9.3",
      "cpe": "cpe:2.3:a:es-module-lexer:es-module-lexer:0.9.3:*:*:*:*:*:*:*",
      "purl": "pkg:npm/es-module-lexer@0.9.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:es-module-lexer:es_module_lexer:0.9.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:es_module_lexer:es-module-lexer:0.9.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:es_module_lexer:es_module_lexer:0.9.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:es-module:es-module-lexer:0.9.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:es-module:es_module_lexer:0.9.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:es_module:es-module-lexer:0.9.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:es_module:es_module_lexer:0.9.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:es:es-module-lexer:0.9.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:es:es_module_lexer:0.9.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/es-module-lexer@0.9.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/es6-object-assign@1.1.0",
      "type": "library",
      "name": "es6-object-assign",
      "version": "1.1.0",
      "cpe": "cpe:2.3:a:es6-object-assign:es6-object-assign:1.1.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/es6-object-assign@1.1.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:es6-object-assign:es6_object_assign:1.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:es6_object_assign:es6-object-assign:1.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:es6_object_assign:es6_object_assign:1.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:es6-object:es6-object-assign:1.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:es6-object:es6_object_assign:1.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:es6_object:es6-object-assign:1.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:es6_object:es6_object_assign:1.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:es6:es6-object-assign:1.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:es6:es6_object_assign:1.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/es6-object-assign@1.1.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/es6-object-assign/1.1.0"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/escalade@3.1.1",
      "type": "library",
      "name": "escalade",
      "version": "3.1.1",
      "cpe": "cpe:2.3:a:escalade:escalade:3.1.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/escalade@3.1.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/escalade@3.1.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/escape-string-regexp@4.0.0",
      "type": "library",
      "name": "escape-string-regexp",
      "version": "4.0.0",
      "cpe": "cpe:2.3:a:escape-string-regexp:escape-string-regexp:4.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/escape-string-regexp@4.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:escape-string-regexp:escape_string_regexp:4.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:escape_string_regexp:escape-string-regexp:4.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:escape_string_regexp:escape_string_regexp:4.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:escape-string:escape-string-regexp:4.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:escape-string:escape_string_regexp:4.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:escape_string:escape-string-regexp:4.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:escape_string:escape_string_regexp:4.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:escape:escape-string-regexp:4.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:escape:escape_string_regexp:4.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/escape-string-regexp@4.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Sindre Sorhus\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Sindre Sorhus",
        "url": [
          "https://github.com/sindresorhus/escape-string-regexp#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/eslint-scope@5.1.1",
      "type": "library",
      "name": "eslint-scope",
      "version": "5.1.1",
      "cpe": "cpe:2.3:a:eslint-scope:eslint-scope:5.1.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/eslint-scope@5.1.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:eslint-scope:eslint_scope:5.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:eslint_scope:eslint-scope:5.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:eslint_scope:eslint_scope:5.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:eslint:eslint-scope:5.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:eslint:eslint_scope:5.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/eslint-scope@5.1.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"openjsfoundation\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "openjsfoundation",
        "url": [
          "https://github.com/eslint/js/blob/main/packages/eslint-scope/README.md"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "BSD-2-Clause",
            "url": "https://spdx.org/licenses/BSD-2-Clause.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/esrecurse@4.3.0",
      "type": "library",
      "name": "esrecurse",
      "version": "4.3.0",
      "cpe": "cpe:2.3:a:esrecurse:esrecurse:4.3.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/esrecurse@4.3.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/esrecurse@4.3.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"constellation\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "constellation",
        "url": [
          "https://github.com/estools/esrecurse"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "BSD-2-Clause",
            "url": "https://spdx.org/licenses/BSD-2-Clause.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/estraverse@4.3.0",
      "type": "library",
      "name": "estraverse",
      "version": "4.3.0",
      "cpe": "cpe:2.3:a:estraverse:estraverse:4.3.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/estraverse@4.3.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/estraverse@4.3.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"nzakas\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "nzakas",
        "url": [
          "https://github.com/estools/estraverse"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "BSD-2-Clause",
            "url": "https://spdx.org/licenses/BSD-2-Clause.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/estraverse@5.3.0",
      "type": "library",
      "name": "estraverse",
      "version": "5.3.0",
      "cpe": "cpe:2.3:a:estraverse:estraverse:5.3.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/estraverse@5.3.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/estraverse@5.3.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"nzakas\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "nzakas",
        "url": [
          "https://github.com/estools/estraverse"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "BSD-2-Clause",
            "url": "https://spdx.org/licenses/BSD-2-Clause.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/events@3.3.0",
      "type": "library",
      "name": "events",
      "version": "3.3.0",
      "cpe": "cpe:2.3:a:events:events:3.3.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/events@3.3.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/events@3.3.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/evp_bytestokey@1.0.3",
      "type": "library",
      "name": "evp_bytestokey",
      "version": "1.0.3",
      "cpe": "cpe:2.3:a:evp-bytestokey:evp-bytestokey:1.0.3:*:*:*:*:*:*:*",
      "purl": "pkg:npm/evp_bytestokey@1.0.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:evp-bytestokey:evp_bytestokey:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:evp_bytestokey:evp-bytestokey:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:evp_bytestokey:evp_bytestokey:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:evp:evp-bytestokey:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:evp:evp_bytestokey:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/evp_bytestokey@1.0.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Unknown",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/execa@5.1.1",
      "type": "library",
      "name": "execa",
      "version": "5.1.1",
      "cpe": "cpe:2.3:a:execa:execa:5.1.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/execa@5.1.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/execa@5.1.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/fast-deep-equal@3.1.3",
      "type": "library",
      "name": "fast-deep-equal",
      "version": "3.1.3",
      "cpe": "cpe:2.3:a:fast-deep-equal:fast-deep-equal:3.1.3:*:*:*:*:*:*:*",
      "purl": "pkg:npm/fast-deep-equal@3.1.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fast-deep-equal:fast_deep_equal:3.1.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fast_deep_equal:fast-deep-equal:3.1.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fast_deep_equal:fast_deep_equal:3.1.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fast-deep:fast-deep-equal:3.1.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fast-deep:fast_deep_equal:3.1.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fast_deep:fast-deep-equal:3.1.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fast_deep:fast_deep_equal:3.1.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fast:fast-deep-equal:3.1.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fast:fast_deep_equal:3.1.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/fast-deep-equal@3.1.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Evgeny Poberezkin\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Evgeny Poberezkin",
        "url": [
          "https://github.com/epoberezkin/fast-deep-equal#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/fast-json-stable-stringify@2.1.0",
      "type": "library",
      "name": "fast-json-stable-stringify",
      "version": "2.1.0",
      "cpe": "cpe:2.3:a:fast-json-stable-stringify:fast-json-stable-stringify:2.1.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/fast-json-stable-stringify@2.1.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fast-json-stable-stringify:fast_json_stable_stringify:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fast_json_stable_stringify:fast-json-stable-stringify:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fast_json_stable_stringify:fast_json_stable_stringify:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fast-json-stable:fast-json-stable-stringify:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fast-json-stable:fast_json_stable_stringify:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fast_json_stable:fast-json-stable-stringify:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fast_json_stable:fast_json_stable_stringify:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fast-json:fast-json-stable-stringify:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fast-json:fast_json_stable_stringify:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fast_json:fast-json-stable-stringify:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fast_json:fast_json_stable_stringify:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fast:fast-json-stable-stringify:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fast:fast_json_stable_stringify:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/fast-json-stable-stringify@2.1.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"James Halliday\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "James Halliday",
        "url": [
          "https://github.com/epoberezkin/fast-json-stable-stringify"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/fastest-levenshtein@1.0.16",
      "type": "library",
      "name": "fastest-levenshtein",
      "version": "1.0.16",
      "cpe": "cpe:2.3:a:fastest-levenshtein:fastest-levenshtein:1.0.16:*:*:*:*:*:*:*",
      "purl": "pkg:npm/fastest-levenshtein@1.0.16",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fastest-levenshtein:fastest_levenshtein:1.0.16:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fastest_levenshtein:fastest-levenshtein:1.0.16:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fastest_levenshtein:fastest_levenshtein:1.0.16:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fastest:fastest-levenshtein:1.0.16:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fastest:fastest_levenshtein:1.0.16:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/fastest-levenshtein@1.0.16\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/fastest-levenshtein/1.0.16"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/fill-range@7.0.1",
      "type": "library",
      "name": "fill-range",
      "version": "7.0.1",
      "cpe": "cpe:2.3:a:fill-range:fill-range:7.0.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/fill-range@7.0.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fill-range:fill_range:7.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fill_range:fill-range:7.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fill_range:fill_range:7.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fill:fill-range:7.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fill:fill_range:7.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/fill-range@7.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Jon Schlinkert\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Jon Schlinkert",
        "url": [
          "https://github.com/jonschlinkert/fill-range"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/find-up@4.1.0",
      "type": "library",
      "name": "find-up",
      "version": "4.1.0",
      "cpe": "cpe:2.3:a:find-up:find-up:4.1.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/find-up@4.1.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:find-up:find_up:4.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:find_up:find-up:4.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:find_up:find_up:4.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:find:find-up:4.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:find:find_up:4.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/find-up@4.1.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Sindre Sorhus\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Sindre Sorhus",
        "url": [
          "https://github.com/sindresorhus/find-up#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/find-up@5.0.0",
      "type": "library",
      "name": "find-up",
      "version": "5.0.0",
      "cpe": "cpe:2.3:a:find-up:find-up:5.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/find-up@5.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:find-up:find_up:5.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:find_up:find-up:5.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:find_up:find_up:5.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:find:find-up:5.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:find:find_up:5.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/find-up@5.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Sindre Sorhus\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Sindre Sorhus",
        "url": [
          "https://github.com/sindresorhus/find-up#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/flat@5.0.2",
      "type": "library",
      "name": "flat",
      "version": "5.0.2",
      "cpe": "cpe:2.3:a:flat:flat:5.0.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/flat@5.0.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/flat@5.0.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "BSD-3-Clause",
            "url": "https://spdx.org/licenses/BSD-3-Clause.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/for-each@0.3.3",
      "type": "library",
      "name": "for-each",
      "version": "0.3.3",
      "cpe": "cpe:2.3:a:for-each:for-each:0.3.3:*:*:*:*:*:*:*",
      "purl": "pkg:npm/for-each@0.3.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:for-each:for_each:0.3.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:for_each:for-each:0.3.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:for_each:for_each:0.3.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:for:for-each:0.3.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:for:for_each:0.3.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/for-each@0.3.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/fs-extra@7.0.1",
      "type": "library",
      "name": "fs-extra",
      "version": "7.0.1",
      "cpe": "cpe:2.3:a:fs-extra:fs-extra:7.0.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/fs-extra@7.0.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fs-extra:fs_extra:7.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fs_extra:fs-extra:7.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fs_extra:fs_extra:7.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fs:fs-extra:7.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:fs:fs_extra:7.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/fs-extra@7.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"known_maintainer\", \"supplier\": \"JP Richardson\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "JP Richardson",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/fs.realpath@1.0.0",
      "type": "library",
      "name": "fs.realpath",
      "version": "1.0.0",
      "cpe": "cpe:2.3:a:fs.realpath:fs.realpath:1.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/fs.realpath@1.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/fs.realpath@1.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Isaac Z. Schlueter\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Isaac Z. Schlueter",
        "url": [
          "https://github.com/isaacs/fs.realpath#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://spdx.org/licenses/ISC.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/fsevents@2.3.2",
      "type": "library",
      "name": "fsevents",
      "version": "2.3.2",
      "cpe": "cpe:2.3:a:fsevents:fsevents:2.3.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/fsevents@2.3.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/fsevents@2.3.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}, {\"code\": \"malicious_version\", \"message\": \"Known malicious package name (all versions): OSV malicious-package record MAL-2023-462 (source: osv_mal)\", \"severity\": \"Critical\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "malicious_version"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/function-bind@1.1.1",
      "type": "library",
      "name": "function-bind",
      "version": "1.1.1",
      "cpe": "cpe:2.3:a:function-bind:function-bind:1.1.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/function-bind@1.1.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:function-bind:function_bind:1.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:function_bind:function-bind:1.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:function_bind:function_bind:1.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:function:function-bind:1.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:function:function_bind:1.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/function-bind@1.1.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/get-caller-file@2.0.5",
      "type": "library",
      "name": "get-caller-file",
      "version": "2.0.5",
      "cpe": "cpe:2.3:a:get-caller-file:get-caller-file:2.0.5:*:*:*:*:*:*:*",
      "purl": "pkg:npm/get-caller-file@2.0.5",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:get-caller-file:get_caller_file:2.0.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:get_caller_file:get-caller-file:2.0.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:get_caller_file:get_caller_file:2.0.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:get-caller:get-caller-file:2.0.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:get-caller:get_caller_file:2.0.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:get_caller:get-caller-file:2.0.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:get_caller:get_caller_file:2.0.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:get:get-caller-file:2.0.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:get:get_caller_file:2.0.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/get-caller-file@2.0.5\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://spdx.org/licenses/ISC.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/get-intrinsic@1.1.3",
      "type": "library",
      "name": "get-intrinsic",
      "version": "1.1.3",
      "cpe": "cpe:2.3:a:get-intrinsic:get-intrinsic:1.1.3:*:*:*:*:*:*:*",
      "purl": "pkg:npm/get-intrinsic@1.1.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:get-intrinsic:get_intrinsic:1.1.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:get_intrinsic:get-intrinsic:1.1.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:get_intrinsic:get_intrinsic:1.1.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:get:get-intrinsic:1.1.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:get:get_intrinsic:1.1.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/get-intrinsic@1.1.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/get-stream@6.0.1",
      "type": "library",
      "name": "get-stream",
      "version": "6.0.1",
      "cpe": "cpe:2.3:a:get-stream:get-stream:6.0.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/get-stream@6.0.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:get-stream:get_stream:6.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:get_stream:get-stream:6.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:get_stream:get_stream:6.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:get:get-stream:6.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:get:get_stream:6.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/get-stream@6.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/glob@7.1.7",
      "type": "library",
      "name": "glob",
      "version": "7.1.7",
      "cpe": "cpe:2.3:a:glob:glob:7.1.7:*:*:*:*:*:*:*",
      "purl": "pkg:npm/glob@7.1.7",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/glob@7.1.7\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"known_maintainer\", \"supplier\": \"Isaac Z. Schlueter\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Isaac Z. Schlueter",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://spdx.org/licenses/ISC.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/glob-parent@5.1.2",
      "type": "library",
      "name": "glob-parent",
      "version": "5.1.2",
      "cpe": "cpe:2.3:a:gulpjs:glob-parent:5.1.2:*:*:*:*:node.js:*:*",
      "purl": "pkg:npm/glob-parent@5.1.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/glob-parent@5.1.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Gulp Team\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Gulp Team",
        "url": [
          "https://github.com/gulpjs/glob-parent#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://spdx.org/licenses/ISC.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/glob-to-regexp@0.4.1",
      "type": "library",
      "name": "glob-to-regexp",
      "version": "0.4.1",
      "cpe": "cpe:2.3:a:glob-to-regexp:glob-to-regexp:0.4.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/glob-to-regexp@0.4.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:glob-to-regexp:glob_to_regexp:0.4.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:glob_to_regexp:glob-to-regexp:0.4.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:glob_to_regexp:glob_to_regexp:0.4.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:glob-to:glob-to-regexp:0.4.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:glob-to:glob_to_regexp:0.4.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:glob_to:glob-to-regexp:0.4.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:glob_to:glob_to_regexp:0.4.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:glob:glob-to-regexp:0.4.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:glob:glob_to_regexp:0.4.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/glob-to-regexp@0.4.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Unknown",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "BSD-2-Clause",
            "url": "https://spdx.org/licenses/BSD-2-Clause.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/gopd@1.0.1",
      "type": "library",
      "name": "gopd",
      "version": "1.0.1",
      "cpe": "cpe:2.3:a:gopd:gopd:1.0.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/gopd@1.0.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/gopd@1.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/graceful-fs@4.2.10",
      "type": "library",
      "name": "graceful-fs",
      "version": "4.2.10",
      "cpe": "cpe:2.3:a:graceful-fs:graceful-fs:4.2.10:*:*:*:*:*:*:*",
      "purl": "pkg:npm/graceful-fs@4.2.10",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:graceful-fs:graceful_fs:4.2.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:graceful_fs:graceful-fs:4.2.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:graceful_fs:graceful_fs:4.2.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:graceful:graceful-fs:4.2.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:graceful:graceful_fs:4.2.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/graceful-fs@4.2.10\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://spdx.org/licenses/ISC.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/growl@1.10.5",
      "type": "library",
      "name": "growl",
      "version": "1.10.5",
      "cpe": "cpe:2.3:a:growl_project:growl:1.10.5:*:*:*:*:node.js:*:*",
      "purl": "pkg:npm/growl@1.10.5",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/growl@1.10.5\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/growl/1.10.5"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/has@1.0.3",
      "type": "library",
      "name": "has",
      "version": "1.0.3",
      "cpe": "cpe:2.3:a:has:has:1.0.3:*:*:*:*:*:*:*",
      "purl": "pkg:npm/has@1.0.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/has@1.0.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/has-flag@4.0.0",
      "type": "library",
      "name": "has-flag",
      "version": "4.0.0",
      "cpe": "cpe:2.3:a:has-flag:has-flag:4.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/has-flag@4.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:has-flag:has_flag:4.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:has_flag:has-flag:4.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:has_flag:has_flag:4.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:has:has-flag:4.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:has:has_flag:4.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/has-flag@4.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Sindre Sorhus\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Sindre Sorhus",
        "url": [
          "https://github.com/sindresorhus/has-flag#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/has-property-descriptors@1.0.0",
      "type": "library",
      "name": "has-property-descriptors",
      "version": "1.0.0",
      "cpe": "cpe:2.3:a:has-property-descriptors:has-property-descriptors:1.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/has-property-descriptors@1.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:has-property-descriptors:has_property_descriptors:1.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:has_property_descriptors:has-property-descriptors:1.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:has_property_descriptors:has_property_descriptors:1.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:has-property:has-property-descriptors:1.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:has-property:has_property_descriptors:1.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:has_property:has-property-descriptors:1.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:has_property:has_property_descriptors:1.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:has:has-property-descriptors:1.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:has:has_property_descriptors:1.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/has-property-descriptors@1.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/has-symbols@1.0.3",
      "type": "library",
      "name": "has-symbols",
      "version": "1.0.3",
      "cpe": "cpe:2.3:a:has-symbols:has-symbols:1.0.3:*:*:*:*:*:*:*",
      "purl": "pkg:npm/has-symbols@1.0.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:has-symbols:has_symbols:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:has_symbols:has-symbols:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:has_symbols:has_symbols:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:has:has-symbols:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:has:has_symbols:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/has-symbols@1.0.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/has-tostringtag@1.0.0",
      "type": "library",
      "name": "has-tostringtag",
      "version": "1.0.0",
      "cpe": "cpe:2.3:a:has-tostringtag:has-tostringtag:1.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/has-tostringtag@1.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:has-tostringtag:has_tostringtag:1.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:has_tostringtag:has-tostringtag:1.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:has_tostringtag:has_tostringtag:1.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:has:has-tostringtag:1.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:has:has_tostringtag:1.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/has-tostringtag@1.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/hash-base@3.1.0",
      "type": "library",
      "name": "hash-base",
      "version": "3.1.0",
      "cpe": "cpe:2.3:a:hash-base:hash-base:3.1.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/hash-base@3.1.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:hash-base:hash_base:3.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:hash_base:hash-base:3.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:hash_base:hash_base:3.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:hash:hash-base:3.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:hash:hash_base:3.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/hash-base@3.1.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/he@1.2.0",
      "type": "library",
      "name": "he",
      "version": "1.2.0",
      "cpe": "cpe:2.3:a:he:he:1.2.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/he@1.2.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/he@1.2.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/https-browserify@1.0.0",
      "type": "library",
      "name": "https-browserify",
      "version": "1.0.0",
      "cpe": "cpe:2.3:a:https-browserify:https-browserify:1.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/https-browserify@1.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:https-browserify:https_browserify:1.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:https_browserify:https-browserify:1.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:https_browserify:https_browserify:1.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:https:https-browserify:1.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:https:https_browserify:1.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/https-browserify@1.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/human-signals@2.1.0",
      "type": "library",
      "name": "human-signals",
      "version": "2.1.0",
      "cpe": "cpe:2.3:a:human-signals:human-signals:2.1.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/human-signals@2.1.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:human-signals:human_signals:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:human_signals:human-signals:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:human_signals:human_signals:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:human:human-signals:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:human:human_signals:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/human-signals@2.1.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://spdx.org/licenses/Apache-2.0.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/import-lazy@4.0.0",
      "type": "library",
      "name": "import-lazy",
      "version": "4.0.0",
      "cpe": "cpe:2.3:a:import-lazy:import-lazy:4.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/import-lazy@4.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:import-lazy:import_lazy:4.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:import_lazy:import-lazy:4.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:import_lazy:import_lazy:4.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:import:import-lazy:4.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:import:import_lazy:4.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/import-lazy@4.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/import-lazy/4.0.0"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/import-local@3.1.0",
      "type": "library",
      "name": "import-local",
      "version": "3.1.0",
      "cpe": "cpe:2.3:a:import-local:import-local:3.1.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/import-local@3.1.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:import-local:import_local:3.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:import_local:import-local:3.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:import_local:import_local:3.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:import:import-local:3.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:import:import_local:3.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/import-local@3.1.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/inflight@1.0.6",
      "type": "library",
      "name": "inflight",
      "version": "1.0.6",
      "cpe": "cpe:2.3:a:inflight:inflight:1.0.6:*:*:*:*:*:*:*",
      "purl": "pkg:npm/inflight@1.0.6",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/inflight@1.0.6\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Isaac Z. Schlueter\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Isaac Z. Schlueter",
        "url": [
          "https://github.com/isaacs/inflight"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://spdx.org/licenses/ISC.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/interpret@1.4.0",
      "type": "library",
      "name": "interpret",
      "version": "1.4.0",
      "cpe": "cpe:2.3:a:interpret:interpret:1.4.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/interpret@1.4.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/interpret@1.4.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/interpret@2.2.0",
      "type": "library",
      "name": "interpret",
      "version": "2.2.0",
      "cpe": "cpe:2.3:a:interpret:interpret:2.2.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/interpret@2.2.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/interpret@2.2.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/is-arguments@1.1.1",
      "type": "library",
      "name": "is-arguments",
      "version": "1.1.1",
      "cpe": "cpe:2.3:a:is-arguments:is-arguments:1.1.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/is-arguments@1.1.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-arguments:is_arguments:1.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_arguments:is-arguments:1.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_arguments:is_arguments:1.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is-arguments:1.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is_arguments:1.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/is-arguments@1.1.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/is-binary-path@2.1.0",
      "type": "library",
      "name": "is-binary-path",
      "version": "2.1.0",
      "cpe": "cpe:2.3:a:is-binary-path:is-binary-path:2.1.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/is-binary-path@2.1.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-binary-path:is_binary_path:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_binary_path:is-binary-path:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_binary_path:is_binary_path:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-binary:is-binary-path:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-binary:is_binary_path:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_binary:is-binary-path:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_binary:is_binary_path:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is-binary-path:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is_binary_path:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/is-binary-path@2.1.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/is-callable@1.2.7",
      "type": "library",
      "name": "is-callable",
      "version": "1.2.7",
      "cpe": "cpe:2.3:a:is-callable:is-callable:1.2.7:*:*:*:*:*:*:*",
      "purl": "pkg:npm/is-callable@1.2.7",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-callable:is_callable:1.2.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_callable:is-callable:1.2.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_callable:is_callable:1.2.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is-callable:1.2.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is_callable:1.2.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/is-callable@1.2.7\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/is-core-module@2.11.0",
      "type": "library",
      "name": "is-core-module",
      "version": "2.11.0",
      "cpe": "cpe:2.3:a:is-core-module:is-core-module:2.11.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/is-core-module@2.11.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-core-module:is_core_module:2.11.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_core_module:is-core-module:2.11.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_core_module:is_core_module:2.11.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-core:is-core-module:2.11.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-core:is_core_module:2.11.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_core:is-core-module:2.11.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_core:is_core_module:2.11.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is-core-module:2.11.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is_core_module:2.11.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/is-core-module@2.11.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/is-extglob@2.1.1",
      "type": "library",
      "name": "is-extglob",
      "version": "2.1.1",
      "cpe": "cpe:2.3:a:is-extglob:is-extglob:2.1.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/is-extglob@2.1.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-extglob:is_extglob:2.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_extglob:is-extglob:2.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_extglob:is_extglob:2.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is-extglob:2.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is_extglob:2.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/is-extglob@2.1.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Jon Schlinkert\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Jon Schlinkert",
        "url": [
          "https://github.com/jonschlinkert/is-extglob"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/is-fullwidth-code-point@3.0.0",
      "type": "library",
      "name": "is-fullwidth-code-point",
      "version": "3.0.0",
      "cpe": "cpe:2.3:a:is-fullwidth-code-point:is-fullwidth-code-point:3.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/is-fullwidth-code-point@3.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-fullwidth-code-point:is_fullwidth_code_point:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_fullwidth_code_point:is-fullwidth-code-point:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_fullwidth_code_point:is_fullwidth_code_point:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-fullwidth-code:is-fullwidth-code-point:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-fullwidth-code:is_fullwidth_code_point:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_fullwidth_code:is-fullwidth-code-point:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_fullwidth_code:is_fullwidth_code_point:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-fullwidth:is-fullwidth-code-point:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-fullwidth:is_fullwidth_code_point:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_fullwidth:is-fullwidth-code-point:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_fullwidth:is_fullwidth_code_point:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is-fullwidth-code-point:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is_fullwidth_code_point:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/is-fullwidth-code-point@3.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/is-generator-function@1.0.10",
      "type": "library",
      "name": "is-generator-function",
      "version": "1.0.10",
      "cpe": "cpe:2.3:a:is-generator-function:is-generator-function:1.0.10:*:*:*:*:*:*:*",
      "purl": "pkg:npm/is-generator-function@1.0.10",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-generator-function:is_generator_function:1.0.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_generator_function:is-generator-function:1.0.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_generator_function:is_generator_function:1.0.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-generator:is-generator-function:1.0.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-generator:is_generator_function:1.0.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_generator:is-generator-function:1.0.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_generator:is_generator_function:1.0.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is-generator-function:1.0.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is_generator_function:1.0.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/is-generator-function@1.0.10\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/is-glob@4.0.3",
      "type": "library",
      "name": "is-glob",
      "version": "4.0.3",
      "cpe": "cpe:2.3:a:is-glob:is-glob:4.0.3:*:*:*:*:*:*:*",
      "purl": "pkg:npm/is-glob@4.0.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-glob:is_glob:4.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_glob:is-glob:4.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_glob:is_glob:4.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is-glob:4.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is_glob:4.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/is-glob@4.0.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Jon Schlinkert\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Jon Schlinkert",
        "url": [
          "https://github.com/micromatch/is-glob"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/is-nan@1.3.2",
      "type": "library",
      "name": "is-nan",
      "version": "1.3.2",
      "cpe": "cpe:2.3:a:is-nan:is-nan:1.3.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/is-nan@1.3.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-nan:is_nan:1.3.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_nan:is-nan:1.3.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_nan:is_nan:1.3.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is-nan:1.3.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is_nan:1.3.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/is-nan@1.3.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/is-nan/1.3.2"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/is-number@7.0.0",
      "type": "library",
      "name": "is-number",
      "version": "7.0.0",
      "cpe": "cpe:2.3:a:is-number:is-number:7.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/is-number@7.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-number:is_number:7.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_number:is-number:7.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_number:is_number:7.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is-number:7.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is_number:7.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/is-number@7.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Jon Schlinkert\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Jon Schlinkert",
        "url": [
          "https://github.com/jonschlinkert/is-number"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/is-plain-obj@2.1.0",
      "type": "library",
      "name": "is-plain-obj",
      "version": "2.1.0",
      "cpe": "cpe:2.3:a:is-plain-obj:is-plain-obj:2.1.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/is-plain-obj@2.1.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-plain-obj:is_plain_obj:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_plain_obj:is-plain-obj:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_plain_obj:is_plain_obj:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-plain:is-plain-obj:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-plain:is_plain_obj:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_plain:is-plain-obj:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_plain:is_plain_obj:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is-plain-obj:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is_plain_obj:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/is-plain-obj@2.1.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/is-plain-object@2.0.4",
      "type": "library",
      "name": "is-plain-object",
      "version": "2.0.4",
      "cpe": "cpe:2.3:a:is-plain-object:is-plain-object:2.0.4:*:*:*:*:*:*:*",
      "purl": "pkg:npm/is-plain-object@2.0.4",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-plain-object:is_plain_object:2.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_plain_object:is-plain-object:2.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_plain_object:is_plain_object:2.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-plain:is-plain-object:2.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-plain:is_plain_object:2.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_plain:is-plain-object:2.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_plain:is_plain_object:2.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is-plain-object:2.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is_plain_object:2.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/is-plain-object@2.0.4\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/is-stream@2.0.1",
      "type": "library",
      "name": "is-stream",
      "version": "2.0.1",
      "cpe": "cpe:2.3:a:is-stream:is-stream:2.0.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/is-stream@2.0.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-stream:is_stream:2.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_stream:is-stream:2.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_stream:is_stream:2.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is-stream:2.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is_stream:2.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/is-stream@2.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/is-typed-array@1.1.10",
      "type": "library",
      "name": "is-typed-array",
      "version": "1.1.10",
      "cpe": "cpe:2.3:a:is-typed-array:is-typed-array:1.1.10:*:*:*:*:*:*:*",
      "purl": "pkg:npm/is-typed-array@1.1.10",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-typed-array:is_typed_array:1.1.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_typed_array:is-typed-array:1.1.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_typed_array:is_typed_array:1.1.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-typed:is-typed-array:1.1.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-typed:is_typed_array:1.1.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_typed:is-typed-array:1.1.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_typed:is_typed_array:1.1.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is-typed-array:1.1.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is_typed_array:1.1.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/is-typed-array@1.1.10\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/is-unicode-supported@0.1.0",
      "type": "library",
      "name": "is-unicode-supported",
      "version": "0.1.0",
      "cpe": "cpe:2.3:a:is-unicode-supported:is-unicode-supported:0.1.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/is-unicode-supported@0.1.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-unicode-supported:is_unicode_supported:0.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_unicode_supported:is-unicode-supported:0.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_unicode_supported:is_unicode_supported:0.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-unicode:is-unicode-supported:0.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is-unicode:is_unicode_supported:0.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_unicode:is-unicode-supported:0.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is_unicode:is_unicode_supported:0.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is-unicode-supported:0.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:is:is_unicode_supported:0.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/is-unicode-supported@0.1.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/isexe@2.0.0",
      "type": "library",
      "name": "isexe",
      "version": "2.0.0",
      "cpe": "cpe:2.3:a:isexe:isexe:2.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/isexe@2.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/isexe@2.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Isaac Z. Schlueter\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Isaac Z. Schlueter",
        "url": [
          "https://github.com/isaacs/isexe#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://spdx.org/licenses/ISC.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/isobject@3.0.1",
      "type": "library",
      "name": "isobject",
      "version": "3.0.1",
      "cpe": "cpe:2.3:a:isobject:isobject:3.0.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/isobject@3.0.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/isobject@3.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/jest-worker@27.5.1",
      "type": "library",
      "name": "jest-worker",
      "version": "27.5.1",
      "cpe": "cpe:2.3:a:jest-worker:jest-worker:27.5.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/jest-worker@27.5.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:jest-worker:jest_worker:27.5.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:jest_worker:jest-worker:27.5.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:jest_worker:jest_worker:27.5.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:jest:jest-worker:27.5.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:jest:jest_worker:27.5.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/jest-worker@27.5.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/jju@1.4.0",
      "type": "library",
      "name": "jju",
      "version": "1.4.0",
      "cpe": "cpe:2.3:a:jju:jju:1.4.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/jju@1.4.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/jju@1.4.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/jju/1.4.0"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/js-yaml@4.1.0",
      "type": "library",
      "name": "js-yaml",
      "version": "4.1.0",
      "cpe": "cpe:2.3:a:js-yaml:js-yaml:4.1.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/js-yaml@4.1.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:js-yaml:js_yaml:4.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:js_yaml:js-yaml:4.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:js_yaml:js_yaml:4.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:js:js-yaml:4.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:js:js_yaml:4.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/js-yaml@4.1.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Vladimir Zapparov\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Vladimir Zapparov",
        "url": [
          "https://github.com/nodeca/js-yaml#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/json-parse-better-errors@1.0.2",
      "type": "library",
      "name": "json-parse-better-errors",
      "version": "1.0.2",
      "cpe": "cpe:2.3:a:json-parse-better-errors:json-parse-better-errors:1.0.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/json-parse-better-errors@1.0.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:json-parse-better-errors:json_parse_better_errors:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:json_parse_better_errors:json-parse-better-errors:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:json_parse_better_errors:json_parse_better_errors:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:json-parse-better:json-parse-better-errors:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:json-parse-better:json_parse_better_errors:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:json_parse_better:json-parse-better-errors:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:json_parse_better:json_parse_better_errors:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:json-parse:json-parse-better-errors:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:json-parse:json_parse_better_errors:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:json_parse:json-parse-better-errors:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:json_parse:json_parse_better_errors:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:json:json-parse-better-errors:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:json:json_parse_better_errors:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/json-parse-better-errors@1.0.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/json-parse-better-errors/1.0.2"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/json-schema-traverse@0.4.1",
      "type": "library",
      "name": "json-schema-traverse",
      "version": "0.4.1",
      "cpe": "cpe:2.3:a:json-schema-traverse:json-schema-traverse:0.4.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/json-schema-traverse@0.4.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:json-schema-traverse:json_schema_traverse:0.4.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:json_schema_traverse:json-schema-traverse:0.4.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:json_schema_traverse:json_schema_traverse:0.4.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:json-schema:json-schema-traverse:0.4.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:json-schema:json_schema_traverse:0.4.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:json_schema:json-schema-traverse:0.4.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:json_schema:json_schema_traverse:0.4.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:json:json-schema-traverse:0.4.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:json:json_schema_traverse:0.4.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/json-schema-traverse@0.4.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Evgeny Poberezkin\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Evgeny Poberezkin",
        "url": [
          "https://github.com/epoberezkin/json-schema-traverse#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/json5@2.2.1",
      "type": "library",
      "name": "json5",
      "version": "2.2.1",
      "cpe": "cpe:2.3:a:json5:json5:2.2.1:*:*:*:*:node.js:*:*",
      "purl": "pkg:npm/json5@2.2.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/json5@2.2.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/jsonfile@4.0.0",
      "type": "library",
      "name": "jsonfile",
      "version": "4.0.0",
      "cpe": "cpe:2.3:a:jsonfile:jsonfile:4.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/jsonfile@4.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/jsonfile@4.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/kind-of@6.0.3",
      "type": "library",
      "name": "kind-of",
      "version": "6.0.3",
      "cpe": "cpe:2.3:a:kind-of:kind-of:6.0.3:*:*:*:*:*:*:*",
      "purl": "pkg:npm/kind-of@6.0.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:kind-of:kind_of:6.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:kind_of:kind-of:6.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:kind_of:kind_of:6.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:kind:kind-of:6.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:kind:kind_of:6.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/kind-of@6.0.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/level-js@6.1.0",
      "type": "library",
      "name": "level-js",
      "version": "6.1.0",
      "cpe": "cpe:2.3:a:level-js:level-js:6.1.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/level-js@6.1.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:level-js:level_js:6.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:level_js:level-js:6.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:level_js:level_js:6.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:level:level-js:6.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:level:level_js:6.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/level-js@6.1.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/level-js/6.1.0"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/loader-runner@4.3.0",
      "type": "library",
      "name": "loader-runner",
      "version": "4.3.0",
      "cpe": "cpe:2.3:a:loader-runner:loader-runner:4.3.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/loader-runner@4.3.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:loader-runner:loader_runner:4.3.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:loader_runner:loader-runner:4.3.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:loader_runner:loader_runner:4.3.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:loader:loader-runner:4.3.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:loader:loader_runner:4.3.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/loader-runner@4.3.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/loader-utils@2.0.4",
      "type": "library",
      "name": "loader-utils",
      "version": "2.0.4",
      "cpe": "cpe:2.3:a:loader-utils:loader-utils:2.0.4:*:*:*:*:*:*:*",
      "purl": "pkg:npm/loader-utils@2.0.4",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:loader-utils:loader_utils:2.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:loader_utils:loader-utils:2.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:loader_utils:loader_utils:2.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:loader:loader-utils:2.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:loader:loader_utils:2.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/loader-utils@2.0.4\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/locate-path@5.0.0",
      "type": "library",
      "name": "locate-path",
      "version": "5.0.0",
      "cpe": "cpe:2.3:a:locate-path:locate-path:5.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/locate-path@5.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:locate-path:locate_path:5.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:locate_path:locate-path:5.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:locate_path:locate_path:5.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:locate:locate-path:5.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:locate:locate_path:5.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/locate-path@5.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Sindre Sorhus\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Sindre Sorhus",
        "url": [
          "https://github.com/sindresorhus/locate-path#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/locate-path@6.0.0",
      "type": "library",
      "name": "locate-path",
      "version": "6.0.0",
      "cpe": "cpe:2.3:a:locate-path:locate-path:6.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/locate-path@6.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:locate-path:locate_path:6.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:locate_path:locate-path:6.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:locate_path:locate_path:6.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:locate:locate-path:6.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:locate:locate_path:6.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/locate-path@6.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Sindre Sorhus\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Sindre Sorhus",
        "url": [
          "https://github.com/sindresorhus/locate-path#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/lodash.get@4.4.2",
      "type": "library",
      "name": "lodash.get",
      "version": "4.4.2",
      "cpe": "cpe:2.3:a:lodash.get:lodash.get:4.4.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/lodash.get@4.4.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/lodash.get@4.4.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Unknown",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/lodash.isequal@4.5.0",
      "type": "library",
      "name": "lodash.isequal",
      "version": "4.5.0",
      "cpe": "cpe:2.3:a:lodash.isequal:lodash.isequal:4.5.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/lodash.isequal@4.5.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/lodash.isequal@4.5.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Unknown",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/log-symbols@4.1.0",
      "type": "library",
      "name": "log-symbols",
      "version": "4.1.0",
      "cpe": "cpe:2.3:a:log-symbols:log-symbols:4.1.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/log-symbols@4.1.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:log-symbols:log_symbols:4.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:log_symbols:log-symbols:4.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:log_symbols:log_symbols:4.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:log:log-symbols:4.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:log:log_symbols:4.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/log-symbols@4.1.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Unknown",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/lru-cache@6.0.0",
      "type": "library",
      "name": "lru-cache",
      "version": "6.0.0",
      "cpe": "cpe:2.3:a:lru-cache:lru-cache:6.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/lru-cache@6.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:lru-cache:lru_cache:6.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:lru_cache:lru-cache:6.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:lru_cache:lru_cache:6.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:lru:lru-cache:6.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:lru:lru_cache:6.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft, cdxgen"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.9"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/lru-cache@6.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://spdx.org/licenses/ISC.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.9,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              },
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/ltgt@2.2.1",
      "type": "library",
      "name": "ltgt",
      "version": "2.2.1",
      "cpe": "cpe:2.3:a:ltgt:ltgt:2.2.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/ltgt@2.2.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/ltgt@2.2.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/ltgt/2.2.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/make-error@1.3.6",
      "type": "library",
      "name": "make-error",
      "version": "1.3.6",
      "cpe": "cpe:2.3:a:make-error:make-error:1.3.6:*:*:*:*:*:*:*",
      "purl": "pkg:npm/make-error@1.3.6",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:make-error:make_error:1.3.6:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:make_error:make-error:1.3.6:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:make_error:make_error:1.3.6:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:make:make-error:1.3.6:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:make:make_error:1.3.6:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/make-error@1.3.6\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://spdx.org/licenses/ISC.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/mcl-wasm@0.9.0",
      "type": "library",
      "name": "mcl-wasm",
      "version": "0.9.0",
      "cpe": "cpe:2.3:a:mcl-wasm:mcl-wasm:0.9.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/mcl-wasm@0.9.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:mcl-wasm:mcl_wasm:0.9.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:mcl_wasm:mcl-wasm:0.9.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:mcl_wasm:mcl_wasm:0.9.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:mcl:mcl-wasm:0.9.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:mcl:mcl_wasm:0.9.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/mcl-wasm@0.9.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/mcl-wasm/0.9.0"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "BSD-3-Clause"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/md5.js@1.3.5",
      "type": "library",
      "name": "md5.js",
      "version": "1.3.5",
      "cpe": "cpe:2.3:a:md5.js:md5.js:1.3.5:*:*:*:*:*:*:*",
      "purl": "pkg:npm/md5.js@1.3.5",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/md5.js@1.3.5\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/merge-stream@2.0.0",
      "type": "library",
      "name": "merge-stream",
      "version": "2.0.0",
      "cpe": "cpe:2.3:a:merge-stream:merge-stream:2.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/merge-stream@2.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:merge-stream:merge_stream:2.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:merge_stream:merge-stream:2.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:merge_stream:merge_stream:2.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:merge:merge-stream:2.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:merge:merge_stream:2.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/merge-stream@2.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/micromatch@4.0.5",
      "type": "library",
      "name": "micromatch",
      "version": "4.0.5",
      "cpe": "cpe:2.3:a:micromatch:micromatch:4.0.5:*:*:*:*:*:*:*",
      "purl": "pkg:npm/micromatch@4.0.5",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/micromatch@4.0.5\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"known_maintainer\", \"supplier\": \"Jon Schlinkert\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Jon Schlinkert",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/miller-rabin@4.0.1",
      "type": "library",
      "name": "miller-rabin",
      "version": "4.0.1",
      "cpe": "cpe:2.3:a:miller-rabin:miller-rabin:4.0.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/miller-rabin@4.0.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:miller-rabin:miller_rabin:4.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:miller_rabin:miller-rabin:4.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:miller_rabin:miller_rabin:4.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:miller:miller-rabin:4.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:miller:miller_rabin:4.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/miller-rabin@4.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/mime-db@1.52.0",
      "type": "library",
      "name": "mime-db",
      "version": "1.52.0",
      "cpe": "cpe:2.3:a:mime-db:mime-db:1.52.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/mime-db@1.52.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:mime-db:mime_db:1.52.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:mime_db:mime-db:1.52.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:mime_db:mime_db:1.52.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:mime:mime-db:1.52.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:mime:mime_db:1.52.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/mime-db@1.52.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/mime-types@2.1.35",
      "type": "library",
      "name": "mime-types",
      "version": "2.1.35",
      "cpe": "cpe:2.3:a:mime-types:mime-types:2.1.35:*:*:*:*:*:*:*",
      "purl": "pkg:npm/mime-types@2.1.35",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:mime-types:mime_types:2.1.35:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:mime_types:mime-types:2.1.35:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:mime_types:mime_types:2.1.35:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:mime:mime-types:2.1.35:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:mime:mime_types:2.1.35:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/mime-types@2.1.35\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/mimic-fn@2.1.0",
      "type": "library",
      "name": "mimic-fn",
      "version": "2.1.0",
      "cpe": "cpe:2.3:a:mimic-fn:mimic-fn:2.1.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/mimic-fn@2.1.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:mimic-fn:mimic_fn:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:mimic_fn:mimic-fn:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:mimic_fn:mimic_fn:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:mimic:mimic-fn:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:mimic:mimic_fn:2.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/mimic-fn@2.1.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/minimatch@3.0.4",
      "type": "library",
      "name": "minimatch",
      "version": "3.0.4",
      "cpe": "cpe:2.3:a:minimatch_project:minimatch:3.0.4:*:*:*:*:node.js:*:*",
      "purl": "pkg:npm/minimatch@3.0.4",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/minimatch@3.0.4\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"known_maintainer\", \"supplier\": \"Isaac Z. Schlueter\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Isaac Z. Schlueter",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://spdx.org/licenses/ISC.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/minimist@1.2.7",
      "type": "library",
      "name": "minimist",
      "version": "1.2.7",
      "cpe": "cpe:2.3:a:minimist:minimist:1.2.7:*:*:*:*:*:*:*",
      "purl": "pkg:npm/minimist@1.2.7",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/minimist@1.2.7\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"James Halliday\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "James Halliday",
        "url": [
          "https://github.com/minimistjs/minimist"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/mocha@9.1.3",
      "type": "library",
      "name": "mocha",
      "version": "9.1.3",
      "cpe": "cpe:2.3:a:mochajs:mocha:9.1.3:*:*:*:*:node.js:*:*",
      "purl": "pkg:npm/mocha@9.1.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/mocha@9.1.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/ms@2.1.2",
      "type": "library",
      "name": "ms",
      "version": "2.1.2",
      "cpe": "cpe:2.3:a:vercel:ms:2.1.2:*:*:*:*:node.js:*:*",
      "purl": "pkg:npm/ms@2.1.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/ms@2.1.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"matheuss\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "matheuss",
        "url": [
          "https://github.com/vercel/ms#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/ms@2.1.3",
      "type": "library",
      "name": "ms",
      "version": "2.1.3",
      "cpe": "cpe:2.3:a:vercel:ms:2.1.3:*:*:*:*:node.js:*:*",
      "purl": "pkg:npm/ms@2.1.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/ms@2.1.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"matheuss\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "matheuss",
        "url": [
          "https://github.com/vercel/ms#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/nanoid@3.1.25",
      "type": "library",
      "name": "nanoid",
      "version": "3.1.25",
      "cpe": "cpe:2.3:a:nanoid_project:nanoid:3.1.25:*:*:*:*:node.js:*:*",
      "purl": "pkg:npm/nanoid@3.1.25",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/nanoid@3.1.25\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/neo-async@2.6.2",
      "type": "library",
      "name": "neo-async",
      "version": "2.6.2",
      "cpe": "cpe:2.3:a:neo-async:neo-async:2.6.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/neo-async@2.6.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:neo-async:neo_async:2.6.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:neo_async:neo-async:2.6.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:neo_async:neo_async:2.6.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:neo:neo-async:2.6.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:neo:neo_async:2.6.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/neo-async@2.6.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Unknown",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/node-loader@1.0.2",
      "type": "library",
      "name": "node-loader",
      "version": "1.0.2",
      "cpe": "cpe:2.3:a:node-loader:node-loader:1.0.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/node-loader@1.0.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:node-loader:node_loader:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:node_loader:node-loader:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:node_loader:node_loader:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:node:node-loader:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:node:node_loader:1.0.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/node-loader@1.0.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/node-loader/1.0.2"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/node-releases@2.0.6",
      "type": "library",
      "name": "node-releases",
      "version": "2.0.6",
      "cpe": "cpe:2.3:a:node-releases:node-releases:2.0.6:*:*:*:*:*:*:*",
      "purl": "pkg:npm/node-releases@2.0.6",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:node-releases:node_releases:2.0.6:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:node_releases:node-releases:2.0.6:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:node_releases:node_releases:2.0.6:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:node:node-releases:2.0.6:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:node:node_releases:2.0.6:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/node-releases@2.0.6\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/normalize-path@3.0.0",
      "type": "library",
      "name": "normalize-path",
      "version": "3.0.0",
      "cpe": "cpe:2.3:a:normalize-path:normalize-path:3.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/normalize-path@3.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:normalize-path:normalize_path:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:normalize_path:normalize-path:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:normalize_path:normalize_path:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:normalize:normalize-path:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:normalize:normalize_path:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/normalize-path@3.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/npm-run-path@4.0.1",
      "type": "library",
      "name": "npm-run-path",
      "version": "4.0.1",
      "cpe": "cpe:2.3:a:npm-run-path:npm-run-path:4.0.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/npm-run-path@4.0.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:npm-run-path:npm_run_path:4.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:npm_run_path:npm-run-path:4.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:npm_run_path:npm_run_path:4.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:npm-run:npm-run-path:4.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:npm-run:npm_run_path:4.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:npm_run:npm-run-path:4.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:npm_run:npm_run_path:4.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:npm:npm-run-path:4.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:npm:npm_run_path:4.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/npm-run-path@4.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/object-is@1.1.5",
      "type": "library",
      "name": "object-is",
      "version": "1.1.5",
      "cpe": "cpe:2.3:a:object-is:object-is:1.1.5:*:*:*:*:*:*:*",
      "purl": "pkg:npm/object-is@1.1.5",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:object-is:object_is:1.1.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:object_is:object-is:1.1.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:object_is:object_is:1.1.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:object:object-is:1.1.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:object:object_is:1.1.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/object-is@1.1.5\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/object-is/1.1.5"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/object-keys@1.1.1",
      "type": "library",
      "name": "object-keys",
      "version": "1.1.1",
      "cpe": "cpe:2.3:a:object-keys:object-keys:1.1.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/object-keys@1.1.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:object-keys:object_keys:1.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:object_keys:object-keys:1.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:object_keys:object_keys:1.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:object:object-keys:1.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:object:object_keys:1.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/object-keys@1.1.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/once@1.4.0",
      "type": "library",
      "name": "once",
      "version": "1.4.0",
      "cpe": "cpe:2.3:a:once:once:1.4.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/once@1.4.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/once@1.4.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Isaac Z. Schlueter\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Isaac Z. Schlueter",
        "url": [
          "https://github.com/isaacs/once#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://spdx.org/licenses/ISC.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/onetime@5.1.2",
      "type": "library",
      "name": "onetime",
      "version": "5.1.2",
      "cpe": "cpe:2.3:a:onetime:onetime:5.1.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/onetime@5.1.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/onetime@5.1.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/os-browserify@0.3.0",
      "type": "library",
      "name": "os-browserify",
      "version": "0.3.0",
      "cpe": "cpe:2.3:a:os-browserify:os-browserify:0.3.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/os-browserify@0.3.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:os-browserify:os_browserify:0.3.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:os_browserify:os-browserify:0.3.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:os_browserify:os_browserify:0.3.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:os:os-browserify:0.3.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:os:os_browserify:0.3.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/os-browserify@0.3.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/p-limit@2.3.0",
      "type": "library",
      "name": "p-limit",
      "version": "2.3.0",
      "cpe": "cpe:2.3:a:p-limit:p-limit:2.3.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/p-limit@2.3.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:p-limit:p_limit:2.3.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:p_limit:p-limit:2.3.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:p_limit:p_limit:2.3.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:p:p-limit:2.3.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:p:p_limit:2.3.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/p-limit@2.3.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Sindre Sorhus\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Sindre Sorhus",
        "url": [
          "https://github.com/sindresorhus/p-limit#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/p-limit@3.1.0",
      "type": "library",
      "name": "p-limit",
      "version": "3.1.0",
      "cpe": "cpe:2.3:a:p-limit:p-limit:3.1.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/p-limit@3.1.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:p-limit:p_limit:3.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:p_limit:p-limit:3.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:p_limit:p_limit:3.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:p:p-limit:3.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:p:p_limit:3.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/p-limit@3.1.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Sindre Sorhus\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Sindre Sorhus",
        "url": [
          "https://github.com/sindresorhus/p-limit#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/p-locate@4.1.0",
      "type": "library",
      "name": "p-locate",
      "version": "4.1.0",
      "cpe": "cpe:2.3:a:p-locate:p-locate:4.1.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/p-locate@4.1.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:p-locate:p_locate:4.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:p_locate:p-locate:4.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:p_locate:p_locate:4.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:p:p-locate:4.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:p:p_locate:4.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/p-locate@4.1.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Sindre Sorhus\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Sindre Sorhus",
        "url": [
          "https://github.com/sindresorhus/p-locate#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/p-locate@5.0.0",
      "type": "library",
      "name": "p-locate",
      "version": "5.0.0",
      "cpe": "cpe:2.3:a:p-locate:p-locate:5.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/p-locate@5.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:p-locate:p_locate:5.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:p_locate:p-locate:5.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:p_locate:p_locate:5.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:p:p-locate:5.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:p:p_locate:5.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/p-locate@5.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Sindre Sorhus\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Sindre Sorhus",
        "url": [
          "https://github.com/sindresorhus/p-locate#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/p-try@2.2.0",
      "type": "library",
      "name": "p-try",
      "version": "2.2.0",
      "cpe": "cpe:2.3:a:p-try:p-try:2.2.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/p-try@2.2.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:p-try:p_try:2.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:p_try:p-try:2.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:p_try:p_try:2.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:p:p-try:2.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:p:p_try:2.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/p-try@2.2.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/parse-asn1@5.1.6",
      "type": "library",
      "name": "parse-asn1",
      "version": "5.1.6",
      "cpe": "cpe:2.3:a:parse-asn1:parse-asn1:5.1.6:*:*:*:*:*:*:*",
      "purl": "pkg:npm/parse-asn1@5.1.6",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:parse-asn1:parse_asn1:5.1.6:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:parse_asn1:parse-asn1:5.1.6:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:parse_asn1:parse_asn1:5.1.6:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:parse:parse-asn1:5.1.6:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:parse:parse_asn1:5.1.6:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/parse-asn1@5.1.6\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://spdx.org/licenses/ISC.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/path-browserify@1.0.1",
      "type": "library",
      "name": "path-browserify",
      "version": "1.0.1",
      "cpe": "cpe:2.3:a:path-browserify:path-browserify:1.0.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/path-browserify@1.0.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:path-browserify:path_browserify:1.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:path_browserify:path-browserify:1.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:path_browserify:path_browserify:1.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:path:path-browserify:1.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:path:path_browserify:1.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/path-browserify@1.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/path-exists@4.0.0",
      "type": "library",
      "name": "path-exists",
      "version": "4.0.0",
      "cpe": "cpe:2.3:a:path-exists:path-exists:4.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/path-exists@4.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:path-exists:path_exists:4.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:path_exists:path-exists:4.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:path_exists:path_exists:4.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:path:path-exists:4.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:path:path_exists:4.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/path-exists@4.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Sindre Sorhus\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Sindre Sorhus",
        "url": [
          "https://github.com/sindresorhus/path-exists#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/path-is-absolute@1.0.1",
      "type": "library",
      "name": "path-is-absolute",
      "version": "1.0.1",
      "cpe": "cpe:2.3:a:path-is-absolute:path-is-absolute:1.0.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/path-is-absolute@1.0.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:path-is-absolute:path_is_absolute:1.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:path_is_absolute:path-is-absolute:1.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:path_is_absolute:path_is_absolute:1.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:path-is:path-is-absolute:1.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:path-is:path_is_absolute:1.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:path_is:path-is-absolute:1.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:path_is:path_is_absolute:1.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:path:path-is-absolute:1.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:path:path_is_absolute:1.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/path-is-absolute@1.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Sindre Sorhus\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Sindre Sorhus",
        "url": [
          "https://github.com/sindresorhus/path-is-absolute#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/path-key@3.1.1",
      "type": "library",
      "name": "path-key",
      "version": "3.1.1",
      "cpe": "cpe:2.3:a:path-key:path-key:3.1.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/path-key@3.1.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:path-key:path_key:3.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:path_key:path-key:3.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:path_key:path_key:3.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:path:path-key:3.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:path:path_key:3.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/path-key@3.1.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Sindre Sorhus\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Sindre Sorhus",
        "url": [
          "https://github.com/sindresorhus/path-key#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/path-parse@1.0.7",
      "type": "library",
      "name": "path-parse",
      "version": "1.0.7",
      "cpe": "cpe:2.3:a:path-parse_project:path-parse:1.0.7:*:*:*:*:node.js:*:*",
      "purl": "pkg:npm/path-parse@1.0.7",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/path-parse@1.0.7\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/pbkdf2@3.1.2",
      "type": "library",
      "name": "pbkdf2",
      "version": "3.1.2",
      "cpe": "cpe:2.3:a:pbkdf2:pbkdf2:3.1.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/pbkdf2@3.1.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/pbkdf2@3.1.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/picocolors@1.0.0",
      "type": "library",
      "name": "picocolors",
      "version": "1.0.0",
      "cpe": "cpe:2.3:a:picocolors:picocolors:1.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/picocolors@1.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/picocolors@1.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://spdx.org/licenses/ISC.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/picomatch@2.3.1",
      "type": "library",
      "name": "picomatch",
      "version": "2.3.1",
      "cpe": "cpe:2.3:a:picomatch:picomatch:2.3.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/picomatch@2.3.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/picomatch@2.3.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"known_maintainer\", \"supplier\": \"Jon Schlinkert\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Jon Schlinkert",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/pkg-dir@4.2.0",
      "type": "library",
      "name": "pkg-dir",
      "version": "4.2.0",
      "cpe": "cpe:2.3:a:pkg-dir:pkg-dir:4.2.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/pkg-dir@4.2.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:pkg-dir:pkg_dir:4.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:pkg_dir:pkg-dir:4.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:pkg_dir:pkg_dir:4.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:pkg:pkg-dir:4.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:pkg:pkg_dir:4.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/pkg-dir@4.2.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/process@0.11.10",
      "type": "library",
      "name": "process",
      "version": "0.11.10",
      "cpe": "cpe:2.3:a:process:process:0.11.10:*:*:*:*:*:*:*",
      "purl": "pkg:npm/process@0.11.10",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/process@0.11.10\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/public-encrypt@4.0.3",
      "type": "library",
      "name": "public-encrypt",
      "version": "4.0.3",
      "cpe": "cpe:2.3:a:public-encrypt:public-encrypt:4.0.3:*:*:*:*:*:*:*",
      "purl": "pkg:npm/public-encrypt@4.0.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:public-encrypt:public_encrypt:4.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:public_encrypt:public-encrypt:4.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:public_encrypt:public_encrypt:4.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:public:public-encrypt:4.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:public:public_encrypt:4.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/public-encrypt@4.0.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/punycode@2.1.1",
      "type": "library",
      "name": "punycode",
      "version": "2.1.1",
      "cpe": "cpe:2.3:a:punycode:punycode:2.1.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/punycode@2.1.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/punycode@2.1.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Mathias Bynens\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Mathias Bynens",
        "url": [
          "https://mths.be/punycode"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/randombytes@2.1.0",
      "type": "library",
      "name": "randombytes",
      "version": "2.1.0",
      "cpe": "cpe:2.3:a:randombytes:randombytes:2.1.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/randombytes@2.1.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/randombytes@2.1.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Unknown",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/randomfill@1.0.4",
      "type": "library",
      "name": "randomfill",
      "version": "1.0.4",
      "cpe": "cpe:2.3:a:randomfill:randomfill:1.0.4:*:*:*:*:*:*:*",
      "purl": "pkg:npm/randomfill@1.0.4",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/randomfill@1.0.4\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Unknown",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/readdirp@3.6.0",
      "type": "library",
      "name": "readdirp",
      "version": "3.6.0",
      "cpe": "cpe:2.3:a:readdirp:readdirp:3.6.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/readdirp@3.6.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/readdirp@3.6.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/rechoir@0.6.2",
      "type": "library",
      "name": "rechoir",
      "version": "0.6.2",
      "cpe": "cpe:2.3:a:rechoir:rechoir:0.6.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/rechoir@0.6.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "verified-npm-release-database"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/rechoir@0.6.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/rechoir@0.7.1",
      "type": "library",
      "name": "rechoir",
      "version": "0.7.1",
      "cpe": "cpe:2.3:a:rechoir:rechoir:0.7.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/rechoir@0.7.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/rechoir@0.7.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/rechoir/0.7.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/require-directory@2.1.1",
      "type": "library",
      "name": "require-directory",
      "version": "2.1.1",
      "cpe": "cpe:2.3:a:require-directory:require-directory:2.1.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/require-directory@2.1.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:require-directory:require_directory:2.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:require_directory:require-directory:2.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:require_directory:require_directory:2.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:require:require-directory:2.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:require:require_directory:2.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/require-directory@2.1.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/resolve@1.17.0",
      "type": "library",
      "name": "resolve",
      "version": "1.17.0",
      "cpe": "cpe:2.3:a:resolve:resolve:1.17.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/resolve@1.17.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/resolve@1.17.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/resolve@1.19.0",
      "type": "library",
      "name": "resolve",
      "version": "1.19.0",
      "cpe": "cpe:2.3:a:resolve:resolve:1.19.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/resolve@1.19.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/resolve@1.19.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/resolve-cwd@3.0.0",
      "type": "library",
      "name": "resolve-cwd",
      "version": "3.0.0",
      "cpe": "cpe:2.3:a:resolve-cwd:resolve-cwd:3.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/resolve-cwd@3.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:resolve-cwd:resolve_cwd:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:resolve_cwd:resolve-cwd:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:resolve_cwd:resolve_cwd:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:resolve:resolve-cwd:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:resolve:resolve_cwd:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/resolve-cwd@3.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/resolve-from@5.0.0",
      "type": "library",
      "name": "resolve-from",
      "version": "5.0.0",
      "cpe": "cpe:2.3:a:resolve-from:resolve-from:5.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/resolve-from@5.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:resolve-from:resolve_from:5.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:resolve_from:resolve-from:5.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:resolve_from:resolve_from:5.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:resolve:resolve-from:5.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:resolve:resolve_from:5.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/resolve-from@5.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Sindre Sorhus\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Sindre Sorhus",
        "url": [
          "https://github.com/sindresorhus/resolve-from#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/ripemd160@2.0.2",
      "type": "library",
      "name": "ripemd160",
      "version": "2.0.2",
      "cpe": "cpe:2.3:a:ripemd160:ripemd160:2.0.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/ripemd160@2.0.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/ripemd160@2.0.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/run-parallel-limit@1.1.0",
      "type": "library",
      "name": "run-parallel-limit",
      "version": "1.1.0",
      "cpe": "cpe:2.3:a:run-parallel-limit:run-parallel-limit:1.1.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/run-parallel-limit@1.1.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:run-parallel-limit:run_parallel_limit:1.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:run_parallel_limit:run-parallel-limit:1.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:run_parallel_limit:run_parallel_limit:1.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:run-parallel:run-parallel-limit:1.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:run-parallel:run_parallel_limit:1.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:run_parallel:run-parallel-limit:1.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:run_parallel:run_parallel_limit:1.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:run:run-parallel-limit:1.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:run:run_parallel_limit:1.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/run-parallel-limit@1.1.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/run-parallel-limit/1.1.0"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/safer-buffer@2.1.2",
      "type": "library",
      "name": "safer-buffer",
      "version": "2.1.2",
      "cpe": "cpe:2.3:a:safer-buffer:safer-buffer:2.1.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/safer-buffer@2.1.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:safer-buffer:safer_buffer:2.1.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:safer_buffer:safer-buffer:2.1.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:safer_buffer:safer_buffer:2.1.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:safer:safer-buffer:2.1.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:safer:safer_buffer:2.1.2:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/safer-buffer@2.1.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/schema-utils@3.1.1",
      "type": "library",
      "name": "schema-utils",
      "version": "3.1.1",
      "cpe": "cpe:2.3:a:schema-utils:schema-utils:3.1.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/schema-utils@3.1.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:schema-utils:schema_utils:3.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:schema_utils:schema-utils:3.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:schema_utils:schema_utils:3.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:schema:schema-utils:3.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:schema:schema_utils:3.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/schema-utils@3.1.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/schema-utils/3.1.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/scrypt-js@3.0.1",
      "type": "library",
      "name": "scrypt-js",
      "version": "3.0.1",
      "cpe": "cpe:2.3:a:scrypt-js:scrypt-js:3.0.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/scrypt-js@3.0.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:scrypt-js:scrypt_js:3.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:scrypt_js:scrypt-js:3.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:scrypt_js:scrypt_js:3.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:scrypt:scrypt-js:3.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:scrypt:scrypt_js:3.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/scrypt-js@3.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/scrypt-js/3.0.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/semver@7.3.8",
      "type": "library",
      "name": "semver",
      "version": "7.3.8",
      "cpe": "cpe:2.3:a:npmjs:semver:7.3.8:*:*:*:*:node.js:*:*",
      "purl": "pkg:npm/semver@7.3.8",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft, cdxgen"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.9"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/semver@7.3.8\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"known_maintainer\", \"supplier\": \"npm Inc.\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Inc",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://spdx.org/licenses/ISC.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.9,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              },
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/serialize-javascript@6.0.0",
      "type": "library",
      "name": "serialize-javascript",
      "version": "6.0.0",
      "cpe": "cpe:2.3:a:verizon:serialize-javascript:6.0.0:*:*:*:*:node.js:*:*",
      "purl": "pkg:npm/serialize-javascript@6.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/serialize-javascript@6.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "matched"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "CVE(s) matched by configured CVE sources"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:component:osv_scan_info",
          "value": "{\"ecosystem\": \"npm\", \"scan_timestamp\": \"2026-09-20T13:20:02.456128\", \"scanner\": \"local_osv\", \"vulnerability_count\": 5}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "BSD-3-Clause",
            "url": "https://spdx.org/licenses/BSD-3-Clause.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/setimmediate@1.0.5",
      "type": "library",
      "name": "setimmediate",
      "version": "1.0.5",
      "cpe": "cpe:2.3:a:setimmediate:setimmediate:1.0.5:*:*:*:*:*:*:*",
      "purl": "pkg:npm/setimmediate@1.0.5",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/setimmediate@1.0.5\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/sha.js@2.4.11",
      "type": "library",
      "name": "sha.js",
      "version": "2.4.11",
      "cpe": "cpe:2.3:a:sha.js:sha.js:2.4.11:*:*:*:*:*:*:*",
      "purl": "pkg:npm/sha.js@2.4.11",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/sha.js@2.4.11\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "matched"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "CVE(s) matched by configured CVE sources"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:component:osv_scan_info",
          "value": "{\"ecosystem\": \"npm\", \"scan_timestamp\": \"2026-09-20T13:20:02.557079\", \"scanner\": \"local_osv\", \"vulnerability_count\": 1}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "name": "(MIT AND BSD-3-Clause)"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/shallow-clone@3.0.1",
      "type": "library",
      "name": "shallow-clone",
      "version": "3.0.1",
      "cpe": "cpe:2.3:a:shallow-clone:shallow-clone:3.0.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/shallow-clone@3.0.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:shallow-clone:shallow_clone:3.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:shallow_clone:shallow-clone:3.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:shallow_clone:shallow_clone:3.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:shallow:shallow-clone:3.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:shallow:shallow_clone:3.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/shallow-clone@3.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/shallow-clone/3.0.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/shebang-command@2.0.0",
      "type": "library",
      "name": "shebang-command",
      "version": "2.0.0",
      "cpe": "cpe:2.3:a:shebang-command:shebang-command:2.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/shebang-command@2.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:shebang-command:shebang_command:2.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:shebang_command:shebang-command:2.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:shebang_command:shebang_command:2.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:shebang:shebang-command:2.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:shebang:shebang_command:2.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/shebang-command@2.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Kevin Mårtensson\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Kevin Mårtensson",
        "url": [
          "https://github.com/kevva/shebang-command#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/shebang-loader@0.0.1",
      "type": "library",
      "name": "shebang-loader",
      "version": "0.0.1",
      "cpe": "cpe:2.3:a:shebang-loader:shebang-loader:0.0.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/shebang-loader@0.0.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:shebang-loader:shebang_loader:0.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:shebang_loader:shebang-loader:0.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:shebang_loader:shebang_loader:0.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:shebang:shebang-loader:0.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:shebang:shebang_loader:0.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/shebang-loader@0.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/shebang-loader/0.0.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/shebang-regex@3.0.0",
      "type": "library",
      "name": "shebang-regex",
      "version": "3.0.0",
      "cpe": "cpe:2.3:a:shebang-regex:shebang-regex:3.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/shebang-regex@3.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:shebang-regex:shebang_regex:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:shebang_regex:shebang-regex:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:shebang_regex:shebang_regex:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:shebang:shebang-regex:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:shebang:shebang_regex:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/shebang-regex@3.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Sindre Sorhus\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Sindre Sorhus",
        "url": [
          "https://github.com/sindresorhus/shebang-regex#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/shelljs@0.8.5",
      "type": "library",
      "name": "shelljs",
      "version": "0.8.5",
      "cpe": "cpe:2.3:a:shelljs:shelljs:0.8.5:*:*:*:*:*:*:*",
      "purl": "pkg:npm/shelljs@0.8.5",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/shelljs@0.8.5\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/shelljs/0.8.5"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "BSD-3-Clause"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/shx@0.3.3",
      "type": "library",
      "name": "shx",
      "version": "0.3.3",
      "cpe": "cpe:2.3:a:shx:shx:0.3.3:*:*:*:*:*:*:*",
      "purl": "pkg:npm/shx@0.3.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/shx@0.3.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/shx/0.3.3"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/signal-exit@3.0.7",
      "type": "library",
      "name": "signal-exit",
      "version": "3.0.7",
      "cpe": "cpe:2.3:a:signal-exit:signal-exit:3.0.7:*:*:*:*:*:*:*",
      "purl": "pkg:npm/signal-exit@3.0.7",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:signal-exit:signal_exit:3.0.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:signal_exit:signal-exit:3.0.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:signal_exit:signal_exit:3.0.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:signal:signal-exit:3.0.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:signal:signal_exit:3.0.7:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/signal-exit@3.0.7\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://spdx.org/licenses/ISC.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/source-map@0.6.1",
      "type": "library",
      "name": "source-map",
      "version": "0.6.1",
      "cpe": "cpe:2.3:a:source-map:source-map:0.6.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/source-map@0.6.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:source-map:source_map:0.6.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:source_map:source-map:0.6.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:source_map:source_map:0.6.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:source:source-map:0.6.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:source:source_map:0.6.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/source-map@0.6.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "BSD-3-Clause",
            "url": "https://spdx.org/licenses/BSD-3-Clause.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/source-map-support@0.5.21",
      "type": "library",
      "name": "source-map-support",
      "version": "0.5.21",
      "cpe": "cpe:2.3:a:source-map-support:source-map-support:0.5.21:*:*:*:*:*:*:*",
      "purl": "pkg:npm/source-map-support@0.5.21",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:source-map-support:source_map_support:0.5.21:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:source_map_support:source-map-support:0.5.21:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:source_map_support:source_map_support:0.5.21:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:source-map:source-map-support:0.5.21:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:source-map:source_map_support:0.5.21:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:source_map:source-map-support:0.5.21:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:source_map:source_map_support:0.5.21:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:source:source-map-support:0.5.21:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:source:source_map_support:0.5.21:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/source-map-support@0.5.21\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/sprintf-js@1.0.3",
      "type": "library",
      "name": "sprintf-js",
      "version": "1.0.3",
      "cpe": "cpe:2.3:a:sprintf-js:sprintf-js:1.0.3:*:*:*:*:*:*:*",
      "purl": "pkg:npm/sprintf-js@1.0.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:sprintf-js:sprintf_js:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:sprintf_js:sprintf-js:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:sprintf_js:sprintf_js:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:sprintf:sprintf-js:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:sprintf:sprintf_js:1.0.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/sprintf-js@1.0.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "BSD-3-Clause",
            "url": "https://spdx.org/licenses/BSD-3-Clause.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/stream-browserify@3.0.0",
      "type": "library",
      "name": "stream-browserify",
      "version": "3.0.0",
      "cpe": "cpe:2.3:a:stream-browserify:stream-browserify:3.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/stream-browserify@3.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:stream-browserify:stream_browserify:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:stream_browserify:stream-browserify:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:stream_browserify:stream_browserify:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:stream:stream-browserify:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:stream:stream_browserify:3.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/stream-browserify@3.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/stream-http@3.2.0",
      "type": "library",
      "name": "stream-http",
      "version": "3.2.0",
      "cpe": "cpe:2.3:a:stream-http:stream-http:3.2.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/stream-http@3.2.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:stream-http:stream_http:3.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:stream_http:stream-http:3.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:stream_http:stream_http:3.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:stream:stream-http:3.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:stream:stream_http:3.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/stream-http@3.2.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/string-argv@0.3.1",
      "type": "library",
      "name": "string-argv",
      "version": "0.3.1",
      "cpe": "cpe:2.3:a:string-argv:string-argv:0.3.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/string-argv@0.3.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:string-argv:string_argv:0.3.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:string_argv:string-argv:0.3.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:string_argv:string_argv:0.3.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:string:string-argv:0.3.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:string:string_argv:0.3.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/string-argv@0.3.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/string-width@4.2.3",
      "type": "library",
      "name": "string-width",
      "version": "4.2.3",
      "cpe": "cpe:2.3:a:string-width:string-width:4.2.3:*:*:*:*:*:*:*",
      "purl": "pkg:npm/string-width@4.2.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:string-width:string_width:4.2.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:string_width:string-width:4.2.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:string_width:string_width:4.2.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:string:string-width:4.2.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:string:string_width:4.2.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/string-width@4.2.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/strip-ansi@6.0.1",
      "type": "library",
      "name": "strip-ansi",
      "version": "6.0.1",
      "cpe": "cpe:2.3:a:strip-ansi:strip-ansi:6.0.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/strip-ansi@6.0.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:strip-ansi:strip_ansi:6.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:strip_ansi:strip-ansi:6.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:strip_ansi:strip_ansi:6.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:strip:strip-ansi:6.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:strip:strip_ansi:6.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/strip-ansi@6.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}, {\"code\": \"malicious_version\", \"message\": \"Known malicious package name (all versions): OSV malicious-package record MAL-2025-46980 (source: osv_mal)\", \"severity\": \"Critical\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "malicious_version"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Sindre Sorhus\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Sindre Sorhus",
        "url": [
          "https://github.com/chalk/strip-ansi#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/strip-final-newline@2.0.0",
      "type": "library",
      "name": "strip-final-newline",
      "version": "2.0.0",
      "cpe": "cpe:2.3:a:strip-final-newline:strip-final-newline:2.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/strip-final-newline@2.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:strip-final-newline:strip_final_newline:2.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:strip_final_newline:strip-final-newline:2.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:strip_final_newline:strip_final_newline:2.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:strip-final:strip-final-newline:2.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:strip-final:strip_final_newline:2.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:strip_final:strip-final-newline:2.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:strip_final:strip_final_newline:2.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:strip:strip-final-newline:2.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:strip:strip_final_newline:2.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/strip-final-newline@2.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/strip-json-comments@3.1.1",
      "type": "library",
      "name": "strip-json-comments",
      "version": "3.1.1",
      "cpe": "cpe:2.3:a:strip-json-comments:strip-json-comments:3.1.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/strip-json-comments@3.1.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:strip-json-comments:strip_json_comments:3.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:strip_json_comments:strip-json-comments:3.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:strip_json_comments:strip_json_comments:3.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:strip-json:strip-json-comments:3.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:strip-json:strip_json_comments:3.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:strip_json:strip-json-comments:3.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:strip_json:strip_json_comments:3.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:strip:strip-json-comments:3.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:strip:strip_json_comments:3.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/strip-json-comments@3.1.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Sindre Sorhus\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Sindre Sorhus",
        "url": [
          "https://github.com/sindresorhus/strip-json-comments#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/supports-color@7.2.0",
      "type": "library",
      "name": "supports-color",
      "version": "7.2.0",
      "cpe": "cpe:2.3:a:supports-color:supports-color:7.2.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/supports-color@7.2.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:supports-color:supports_color:7.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:supports_color:supports-color:7.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:supports_color:supports_color:7.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:supports:supports-color:7.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:supports:supports_color:7.2.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/supports-color@7.2.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}, {\"code\": \"malicious_version\", \"message\": \"Known malicious package name (all versions): OSV malicious-package record MAL-2025-46981 (source: osv_mal)\", \"severity\": \"Critical\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "malicious_version"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Sindre Sorhus\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Sindre Sorhus",
        "url": [
          "https://github.com/chalk/supports-color#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/supports-color@8.1.1",
      "type": "library",
      "name": "supports-color",
      "version": "8.1.1",
      "cpe": "cpe:2.3:a:supports-color:supports-color:8.1.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/supports-color@8.1.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:supports-color:supports_color:8.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:supports_color:supports-color:8.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:supports_color:supports_color:8.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:supports:supports-color:8.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:supports:supports_color:8.1.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/supports-color@8.1.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}, {\"code\": \"malicious_version\", \"message\": \"Known malicious package name (all versions): OSV malicious-package record MAL-2025-46981 (source: osv_mal)\", \"severity\": \"Critical\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "malicious_version"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Sindre Sorhus\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Sindre Sorhus",
        "url": [
          "https://github.com/chalk/supports-color#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/tapable@2.2.1",
      "type": "library",
      "name": "tapable",
      "version": "2.2.1",
      "cpe": "cpe:2.3:a:tapable:tapable:2.2.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/tapable@2.2.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/tapable@2.2.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/terser@5.16.1",
      "type": "library",
      "name": "terser",
      "version": "5.16.1",
      "cpe": "cpe:2.3:a:terser:terser:5.16.1:*:*:*:*:node.js:*:*",
      "purl": "pkg:npm/terser@5.16.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/terser@5.16.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "BSD-2-Clause",
            "url": "https://spdx.org/licenses/BSD-2-Clause.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/terser-webpack-plugin@5.2.5",
      "type": "library",
      "name": "terser-webpack-plugin",
      "version": "5.2.5",
      "cpe": "cpe:2.3:a:terser-webpack-plugin:terser-webpack-plugin:5.2.5:*:*:*:*:*:*:*",
      "purl": "pkg:npm/terser-webpack-plugin@5.2.5",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:terser-webpack-plugin:terser_webpack_plugin:5.2.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:terser_webpack_plugin:terser-webpack-plugin:5.2.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:terser_webpack_plugin:terser_webpack_plugin:5.2.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:terser-webpack:terser-webpack-plugin:5.2.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:terser-webpack:terser_webpack_plugin:5.2.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:terser_webpack:terser-webpack-plugin:5.2.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:terser_webpack:terser_webpack_plugin:5.2.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:terser:terser-webpack-plugin:5.2.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:terser:terser_webpack_plugin:5.2.5:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/terser-webpack-plugin@5.2.5\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/terser-webpack-plugin/5.2.5"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Unknown",
        "url": []
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/timsort@0.3.0",
      "type": "library",
      "name": "timsort",
      "version": "0.3.0",
      "cpe": "cpe:2.3:a:timsort:timsort:0.3.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/timsort@0.3.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/timsort@0.3.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/timsort/0.3.0"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/to-regex-range@5.0.1",
      "type": "library",
      "name": "to-regex-range",
      "version": "5.0.1",
      "cpe": "cpe:2.3:a:to-regex-range:to-regex-range:5.0.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/to-regex-range@5.0.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:to-regex-range:to_regex_range:5.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:to_regex_range:to-regex-range:5.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:to_regex_range:to_regex_range:5.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:to-regex:to-regex-range:5.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:to-regex:to_regex_range:5.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:to_regex:to-regex-range:5.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:to_regex:to_regex_range:5.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:to:to-regex-range:5.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:to:to_regex_range:5.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/to-regex-range@5.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Jon Schlinkert\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Jon Schlinkert",
        "url": [
          "https://github.com/micromatch/to-regex-range"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/ts-loader@9.3.1",
      "type": "library",
      "name": "ts-loader",
      "version": "9.3.1",
      "cpe": "cpe:2.3:a:ts-loader:ts-loader:9.3.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/ts-loader@9.3.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:ts-loader:ts_loader:9.3.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:ts_loader:ts-loader:9.3.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:ts_loader:ts_loader:9.3.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:ts:ts-loader:9.3.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:ts:ts_loader:9.3.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/ts-loader@9.3.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/ts-loader/9.3.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/ts-node@10.9.1",
      "type": "library",
      "name": "ts-node",
      "version": "10.9.1",
      "cpe": "cpe:2.3:a:ts-node:ts-node:10.9.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/ts-node@10.9.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:ts-node:ts_node:10.9.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:ts_node:ts-node:10.9.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:ts_node:ts_node:10.9.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:ts:ts-node:10.9.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:ts:ts_node:10.9.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/ts-node@10.9.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/typescript@4.5.5",
      "type": "library",
      "name": "typescript",
      "version": "4.5.5",
      "cpe": "cpe:2.3:a:typescript:typescript:4.5.5:*:*:*:*:*:*:*",
      "purl": "pkg:npm/typescript@4.5.5",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/typescript@4.5.5\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"known_maintainer\", \"supplier\": \"Microsoft Corporation\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Microsoft Corporation",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://spdx.org/licenses/Apache-2.0.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/typescript@5.1.6",
      "type": "library",
      "name": "typescript",
      "version": "5.1.6",
      "cpe": "cpe:2.3:a:typescript:typescript:5.1.6:*:*:*:*:*:*:*",
      "purl": "pkg:npm/typescript@5.1.6",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/typescript@5.1.6\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"known_maintainer\", \"supplier\": \"Microsoft Corporation\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Microsoft Corporation",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://spdx.org/licenses/Apache-2.0.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/universalify@0.1.2",
      "type": "library",
      "name": "universalify",
      "version": "0.1.2",
      "cpe": "cpe:2.3:a:universalify:universalify:0.1.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/universalify@0.1.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/universalify@0.1.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/update-browserslist-db@1.0.10",
      "type": "library",
      "name": "update-browserslist-db",
      "version": "1.0.10",
      "cpe": "cpe:2.3:a:update-browserslist-db:update-browserslist-db:1.0.10:*:*:*:*:*:*:*",
      "purl": "pkg:npm/update-browserslist-db@1.0.10",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:update-browserslist-db:update_browserslist_db:1.0.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:update_browserslist_db:update-browserslist-db:1.0.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:update_browserslist_db:update_browserslist_db:1.0.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:update-browserslist:update-browserslist-db:1.0.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:update-browserslist:update_browserslist_db:1.0.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:update_browserslist:update-browserslist-db:1.0.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:update_browserslist:update_browserslist_db:1.0.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:update:update-browserslist-db:1.0.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:update:update_browserslist_db:1.0.10:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/update-browserslist-db@1.0.10\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/uri-js@4.4.1",
      "type": "library",
      "name": "uri-js",
      "version": "4.4.1",
      "cpe": "cpe:2.3:a:garycourt:uri-js:4.4.1:*:*:*:*:node.js:*:*",
      "purl": "pkg:npm/uri-js@4.4.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/uri-js@4.4.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Gary Court\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Gary Court",
        "url": [
          "https://github.com/garycourt/uri-js"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "BSD-2-Clause",
            "url": "https://spdx.org/licenses/BSD-2-Clause.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/util@0.12.4",
      "type": "library",
      "name": "util",
      "version": "0.12.4",
      "cpe": "cpe:2.3:a:util:util:0.12.4:*:*:*:*:*:*:*",
      "purl": "pkg:npm/util@0.12.4",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/util@0.12.4\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/v8-compile-cache-lib@3.0.1",
      "type": "library",
      "name": "v8-compile-cache-lib",
      "version": "3.0.1",
      "cpe": "cpe:2.3:a:v8-compile-cache-lib:v8-compile-cache-lib:3.0.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/v8-compile-cache-lib@3.0.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:v8-compile-cache-lib:v8_compile_cache_lib:3.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:v8_compile_cache_lib:v8-compile-cache-lib:3.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:v8_compile_cache_lib:v8_compile_cache_lib:3.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:v8-compile-cache:v8-compile-cache-lib:3.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:v8-compile-cache:v8_compile_cache_lib:3.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:v8_compile_cache:v8-compile-cache-lib:3.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:v8_compile_cache:v8_compile_cache_lib:3.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:v8-compile:v8-compile-cache-lib:3.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:v8-compile:v8_compile_cache_lib:3.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:v8_compile:v8-compile-cache-lib:3.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:v8_compile:v8_compile_cache_lib:3.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:v8:v8-compile-cache-lib:3.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:v8:v8_compile_cache_lib:3.0.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/v8-compile-cache-lib@3.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/validator@13.7.0",
      "type": "library",
      "name": "validator",
      "version": "13.7.0",
      "cpe": "cpe:2.3:a:validator_project:validator:13.7.0:*:*:*:*:node.js:*:*",
      "purl": "pkg:npm/validator@13.7.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/validator@13.7.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/validator/13.7.0"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/watchpack@2.4.0",
      "type": "library",
      "name": "watchpack",
      "version": "2.4.0",
      "cpe": "cpe:2.3:a:watchpack:watchpack:2.4.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/watchpack@2.4.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/watchpack@2.4.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/webpack@5.65.0",
      "type": "library",
      "name": "webpack",
      "version": "5.65.0",
      "cpe": "cpe:2.3:a:webpack.js:webpack:5.65.0:*:*:*:*:node.js:*:*",
      "purl": "pkg:npm/webpack@5.65.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/webpack@5.65.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"known_maintainer\", \"supplier\": \"webpack Contributors\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "webpack Contributors",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/webpack-cli@4.9.1",
      "type": "library",
      "name": "webpack-cli",
      "version": "4.9.1",
      "cpe": "cpe:2.3:a:webpack-cli:webpack-cli:4.9.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/webpack-cli@4.9.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:webpack-cli:webpack_cli:4.9.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:webpack_cli:webpack-cli:4.9.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:webpack_cli:webpack_cli:4.9.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:webpack:webpack-cli:4.9.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:webpack:webpack_cli:4.9.1:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/webpack-cli@4.9.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/webpack-cli/4.9.1"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Unknown",
        "url": []
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/webpack-merge@5.8.0",
      "type": "library",
      "name": "webpack-merge",
      "version": "5.8.0",
      "cpe": "cpe:2.3:a:webpack-merge:webpack-merge:5.8.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/webpack-merge@5.8.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:webpack-merge:webpack_merge:5.8.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:webpack_merge:webpack-merge:5.8.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:webpack_merge:webpack_merge:5.8.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:webpack:webpack-merge:5.8.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:webpack:webpack_merge:5.8.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/webpack-merge@5.8.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/webpack-merge/5.8.0"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Unknown",
        "url": []
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/webpack-sources@3.2.3",
      "type": "library",
      "name": "webpack-sources",
      "version": "3.2.3",
      "cpe": "cpe:2.3:a:webpack-sources:webpack-sources:3.2.3:*:*:*:*:*:*:*",
      "purl": "pkg:npm/webpack-sources@3.2.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:webpack-sources:webpack_sources:3.2.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:webpack_sources:webpack-sources:3.2.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:webpack_sources:webpack_sources:3.2.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:webpack:webpack-sources:3.2.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:webpack:webpack_sources:3.2.3:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/webpack-sources@3.2.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Unknown",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/which@2.0.2",
      "type": "library",
      "name": "which",
      "version": "2.0.2",
      "cpe": "cpe:2.3:a:which:which:2.0.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/which@2.0.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/which@2.0.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"GitHub Inc.\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "GitHub Inc",
        "url": [
          "https://github.com/npm/node-which#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://spdx.org/licenses/ISC.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/which-typed-array@1.1.9",
      "type": "library",
      "name": "which-typed-array",
      "version": "1.1.9",
      "cpe": "cpe:2.3:a:which-typed-array:which-typed-array:1.1.9:*:*:*:*:*:*:*",
      "purl": "pkg:npm/which-typed-array@1.1.9",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:which-typed-array:which_typed_array:1.1.9:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:which_typed_array:which-typed-array:1.1.9:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:which_typed_array:which_typed_array:1.1.9:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:which-typed:which-typed-array:1.1.9:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:which-typed:which_typed_array:1.1.9:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:which_typed:which-typed-array:1.1.9:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:which_typed:which_typed_array:1.1.9:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:which:which-typed-array:1.1.9:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:which:which_typed_array:1.1.9:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/which-typed-array@1.1.9\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/wildcard@2.0.0",
      "type": "library",
      "name": "wildcard",
      "version": "2.0.0",
      "cpe": "cpe:2.3:a:wildcard:wildcard:2.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/wildcard@2.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/wildcard@2.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/wildcard/2.0.0"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "bom-ref": "pkg:npm/workerpool@6.1.5",
      "type": "library",
      "name": "workerpool",
      "version": "6.1.5",
      "cpe": "cpe:2.3:a:workerpool:workerpool:6.1.5:*:*:*:*:*:*:*",
      "purl": "pkg:npm/workerpool@6.1.5",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/workerpool@6.1.5\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://spdx.org/licenses/Apache-2.0.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/wrap-ansi@7.0.0",
      "type": "library",
      "name": "wrap-ansi",
      "version": "7.0.0",
      "cpe": "cpe:2.3:a:wrap-ansi:wrap-ansi:7.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/wrap-ansi@7.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:wrap-ansi:wrap_ansi:7.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:wrap_ansi:wrap-ansi:7.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:wrap_ansi:wrap_ansi:7.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:wrap:wrap-ansi:7.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:wrap:wrap_ansi:7.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/wrap-ansi@7.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}, {\"code\": \"malicious_version\", \"message\": \"Known malicious package name (all versions): OSV malicious-package record MAL-2025-46983 (source: osv_mal)\", \"severity\": \"Critical\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "malicious_version"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/wrappy@1.0.2",
      "type": "library",
      "name": "wrappy",
      "version": "1.0.2",
      "cpe": "cpe:2.3:a:wrappy:wrappy:1.0.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/wrappy@1.0.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/wrappy@1.0.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Isaac Z. Schlueter\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Isaac Z. Schlueter",
        "url": [
          "https://github.com/npm/wrappy"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://spdx.org/licenses/ISC.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/xtend@4.0.2",
      "type": "library",
      "name": "xtend",
      "version": "4.0.2",
      "cpe": "cpe:2.3:a:xtend:xtend:4.0.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/xtend@4.0.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/xtend@4.0.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/y18n@5.0.8",
      "type": "library",
      "name": "y18n",
      "version": "5.0.8",
      "cpe": "cpe:2.3:a:y18n_project:y18n:5.0.8:*:*:*:*:node.js:*:*",
      "purl": "pkg:npm/y18n@5.0.8",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/y18n@5.0.8\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://spdx.org/licenses/ISC.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/yallist@4.0.0",
      "type": "library",
      "name": "yallist",
      "version": "4.0.0",
      "cpe": "cpe:2.3:a:yallist:yallist:4.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/yallist@4.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/yallist@4.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://spdx.org/licenses/ISC.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/yargs@16.2.0",
      "type": "library",
      "name": "yargs",
      "version": "16.2.0",
      "cpe": "cpe:2.3:a:yargs:yargs:16.2.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/yargs@16.2.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/yargs@16.2.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"known_maintainer\", \"supplier\": \"yargs Contributors\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "yargs Contributors",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/yargs-parser@20.2.4",
      "type": "library",
      "name": "yargs-parser",
      "version": "20.2.4",
      "cpe": "cpe:2.3:a:yargs:yargs-parser:20.2.4:*:*:*:*:node.js:*:*",
      "purl": "pkg:npm/yargs-parser@20.2.4",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/yargs-parser@20.2.4\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Unknown",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://spdx.org/licenses/ISC.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/yargs-unparser@2.0.0",
      "type": "library",
      "name": "yargs-unparser",
      "version": "2.0.0",
      "cpe": "cpe:2.3:a:yargs-unparser:yargs-unparser:2.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/yargs-unparser@2.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:yargs-unparser:yargs_unparser:2.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:yargs_unparser:yargs-unparser:2.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:yargs_unparser:yargs_unparser:2.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:yargs:yargs-unparser:2.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:yargs:yargs_unparser:2.0.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/yargs-unparser@2.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Unknown",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/yn@3.1.1",
      "type": "library",
      "name": "yn",
      "version": "3.1.1",
      "cpe": "cpe:2.3:a:yn:yn:3.1.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/yn@3.1.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/yn@3.1.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/yocto-queue@0.1.0",
      "type": "library",
      "name": "yocto-queue",
      "version": "0.1.0",
      "cpe": "cpe:2.3:a:yocto-queue:yocto-queue:0.1.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/yocto-queue@0.1.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:yocto-queue:yocto_queue:0.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:yocto_queue:yocto-queue:0.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:yocto_queue:yocto_queue:0.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:yocto:yocto-queue:0.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:yocto:yocto_queue:0.1.0:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.8"
        },
        {
          "name": "esl:confidence_band",
          "value": "high"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/yocto-queue@0.1.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Sindre Sorhus\"}"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "Sindre Sorhus",
        "url": [
          "https://github.com/sindresorhus/yocto-queue#readme"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.8,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      }
    },
    {
      "bom-ref": "pkg:npm/z-schema@5.0.4",
      "type": "library",
      "name": "z-schema",
      "version": "5.0.4",
      "cpe": "cpe:2.3:a:z-schema:z-schema:5.0.4:*:*:*:*:*:*:*",
      "purl": "pkg:npm/z-schema@5.0.4",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:z-schema:z_schema:5.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:z_schema:z-schema:5.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:z_schema:z_schema:5.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:z:z-schema:5.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:z:z_schema:5.0.4:*:*:*:*:*:*:*"
        },
        {
          "name": "syft:location:0:path",
          "value": "\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "syft"
        },
        {
          "name": "esl:hash:source_file",
          "value": "package-lock.json"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.6"
        },
        {
          "name": "esl:confidence_band",
          "value": "medium"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/z-schema@5.0.4\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/z-schema/5.0.4"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c170e6c875d5fd8979236f79015e630eef40426f3cfa4a2356de46f5d7abcfa6"
        },
        {
          "alg": "SHA-512",
          "content": "29ffaecc62087cc175c09c7593f88ac1084d5747be7d7638d5c7c2d1c6d94e5b02522adcb8368eb99bd142922ebda2c1804f2927570d2d51e68bcd7a8af9f7bc"
        }
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "evidence": {
        "identity": [
          {
            "field": "name",
            "confidence": 0.6,
            "methods": [
              {
                "technique": "binary-analysis",
                "confidence": 0.7,
                "value": "\\package-lock.json"
              },
              {
                "technique": "binary-analysis",
                "confidence": 0.6,
                "value": "detected by syft"
              }
            ]
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "group": "",
      "name": "ethers",
      "version": "6.17.0",
      "scope": "required",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "069caba483c9df2744568c3ccc66b3d43b8f4bb614f03716c6e06763d6b4500fe5bc03f0accafe10f5ec7ebba5eb6f1245a7a43cd78833850587ff7519665a9e"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/ethers@6.17.0",
      "type": "library",
      "bom-ref": "pkg:npm/ethers@6.17.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/ethers/-/ethers-6.17.0.tgz"
        },
        {
          "name": "ImportedModules",
          "value": "ethers,BrowserProvider,ethers/BrowserProvider,ContractFactory,ethers/ContractFactory,parseEther,ethers/parseEther,formatEther,ethers/formatEther,ZeroAddress,ethers/ZeroAddress"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Imported directly by first-party source code"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/ethers@6.17.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ],
        "occurrences": [
          {
            "location": "scripts\\evm.mjs#14"
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "@adraffy",
      "name": "@adraffy/ens-normalize",
      "version": "1.11.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "9e1081577aae1207acb9fedceca61fa5eaea492d784fc6d8baf27c3dc2c9a7ace7919a4573402e5b8a81b6bf1e295c8f3deffc452afbb2094258f53979ac7029"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/@adraffy/ens-normalize@1.11.1",
      "type": "library",
      "bom-ref": "pkg:npm/@adraffy/ens-normalize@1.11.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/@adraffy/ens-normalize/-/ens-normalize-1.11.1.tgz"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@adraffy/ens-normalize@1.11.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "@noble",
      "name": "@noble/curves",
      "version": "1.2.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "a18725acd81168cf52b0150155b6fc33a0d357b6474532ae82eadea18127718e5ceb91ce991cef4a24c4df2e4261a3d8240fc6564ae15c4a05d0cdd86bd3cc9f"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/@noble/curves@1.2.0",
      "type": "library",
      "bom-ref": "pkg:npm/@noble/curves@1.2.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/@noble/curves/-/curves-1.2.0.tgz"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@noble/curves@1.2.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "@noble",
      "name": "@noble/hashes",
      "version": "1.3.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "3150bc100429eccbc4726df429610d163811f8c9267fe0f5f3d5c94e4148970a2153985c05b9f56642aaeca5538b61e67b73cc185dfdd0368be766de56b22285"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/@noble/hashes@1.3.2",
      "type": "library",
      "bom-ref": "pkg:npm/@noble/hashes@1.3.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.3.2.tgz"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@noble/hashes@1.3.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "@types",
      "name": "@types/node",
      "version": "22.7.5",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "8cc2fbb36340ccc59cfff4122756b7a6ba64efc70e3dc846bd726c0b70ba47a3d2328a28cedbd1550133f3d826053058d523cc6aaa39b5e078b8d1cf75eb5285"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/@types/node@22.7.5",
      "type": "library",
      "bom-ref": "pkg:npm/@types/node@22.7.5",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/@types/node/-/node-22.7.5.tgz"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@types/node@22.7.5\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "undici-types",
      "version": "6.19.8",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "bded8a3fa7ff2676cf045ca86c61ee7ab0bd8351581a7fc5f27d4b593c0dc4213377a21fa93c1441c357804b66990e83951ac2d61ad2ac19c264fa2446b0c78f"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/undici-types@6.19.8",
      "type": "library",
      "bom-ref": "pkg:npm/undici-types@6.19.8",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/undici-types/-/undici-types-6.19.8.tgz"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/undici-types@6.19.8\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "aes-js",
      "version": "4.0.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "1bdeb916a6a5b0dcab3ea80418e37b9c8c757bf39510d4a0884233c82eb785a50cbaf367c088088ccb39da195308a864067cbb0363913657d8f59bbe8e61a4d5"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/aes-js@4.0.0",
      "type": "library",
      "bom-ref": "pkg:npm/aes-js@4.0.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/aes-js/-/aes-js-4.0.0-beta.5.tgz"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/aes-js@4.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "tslib",
      "version": "2.7.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "80b5c229d375fe3e3b0221e23a424debd84999c6c64c72342262e66d82c7ca486078dd23546a256bdc958c5833094925b1940c5b9e68f9d5bb217bf74425c3cc"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "0BSD",
            "url": "https://opensource.org/licenses/0BSD"
          }
        }
      ],
      "purl": "pkg:npm/tslib@2.7.0",
      "type": "library",
      "bom-ref": "pkg:npm/tslib@2.7.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/tslib/-/tslib-2.7.0.tgz"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/tslib@2.7.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "ws",
      "version": "8.21.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "56ca76f1bec345c8a6150bebaaed967a4df3d626310c25aa1d807c42c9e4fd2e117da090ccf18fc8136e563255ddc77a5222ad52da7ab0d33bee05afcdc087fa"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/ws@8.21.0",
      "type": "library",
      "bom-ref": "pkg:npm/ws@8.21.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/ws@8.21.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "fast-check",
      "version": "4.10.2",
      "scope": "required",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "88ad9ff98adc9a8786aa4e9f03479ad9ba6d72efe2b4c226e0d7c4a33aba376e7e686ea1eece4765b07f935695edbe70e6c14b3026dbb5152c4d547e0600b7c7"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/fast-check@4.10.2",
      "type": "library",
      "bom-ref": "pkg:npm/fast-check@4.10.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/fast-check/-/fast-check-4.10.2.tgz"
        },
        {
          "name": "ImportedModules",
          "value": "fast-check"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Imported directly by first-party source code"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/fast-check@4.10.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ],
        "occurrences": [
          {
            "location": "scripts\\evm.mjs#7"
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "pure-rand",
      "version": "8.4.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "befb8e1a072e3c9022ae51efb90c354eb3a2c3ba6d6885d79886cdba234e63a94d189247e3d3d0d4a8f89ddefcde73dd42141d89c80e8d5236c88ffd043ebf36"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/pure-rand@8.4.2",
      "type": "library",
      "bom-ref": "pkg:npm/pure-rand@8.4.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/pure-rand/-/pure-rand-8.4.2.tgz"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/pure-rand@8.4.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"package.json\", \"supplier\": \"Nicolas DUBIEN <github@dubien.org>\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "Nicolas DUBIEN <github@dubien.org>",
        "url": [
          "https://github.com/dubzzz"
        ]
      }
    },
    {
      "group": "",
      "name": "ganache",
      "version": "7.9.2",
      "scope": "required",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "ee0b15543a4ef4086b1720cc59697b4a932c3e9a867270338f1cf7937d8b85e20f35deb8a765ec63d19845d85698ababc9beb45b589a58f6560e414a95b4561c"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/ganache@7.9.2",
      "type": "library",
      "bom-ref": "pkg:npm/ganache@7.9.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/ganache/-/ganache-7.9.2.tgz"
        },
        {
          "name": "ImportedModules",
          "value": "ganache"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Imported directly by first-party source code"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/ganache@7.9.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ],
        "occurrences": [
          {
            "location": "scripts\\evm.mjs#5"
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "@trufflesuite",
      "name": "@trufflesuite/bigint-buffer",
      "version": "1.1.10",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "a582100b911c326203ef8b76e86082ebbf78ea681324588b5ce4ff058a3382b7785046362471062e15a2f5c322402b79052a8512f2a4087367a23f364918e213"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://opensource.org/licenses/Apache-2.0"
          }
        }
      ],
      "purl": "pkg:npm/@trufflesuite/bigint-buffer@1.1.10",
      "type": "library",
      "bom-ref": "pkg:npm/@trufflesuite/bigint-buffer@1.1.10",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/@trufflesuite/bigint-buffer/-/bigint-buffer-1.1.10.tgz"
        },
        {
          "name": "cdx:npm:hasInstallScript",
          "value": "true"
        },
        {
          "name": "cdx:npm:inBundle",
          "value": "true"
        },
        {
          "name": "cdx:npm:inDepBundle",
          "value": "true"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@trufflesuite/bigint-buffer@1.1.10\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "node-gyp-build",
      "version": "4.4.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "6a6267402720b51570f52be879b3b704a18448296b7d71825135fd8529f53ae1904d004e66655dd19d0e95e729b9192c2af6ec52a00b13c8e5b3f12b0a500fb9"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/node-gyp-build@4.4.0",
      "type": "library",
      "bom-ref": "pkg:npm/node-gyp-build@4.4.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/node-gyp-build/-/node-gyp-build-4.4.0.tgz"
        },
        {
          "name": "cdx:npm:inBundle",
          "value": "true"
        },
        {
          "name": "cdx:npm:inDepBundle",
          "value": "true"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/node-gyp-build@4.4.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "@trufflesuite",
      "name": "@trufflesuite/uws-js-unofficial",
      "version": "20.30.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "af95f468e41cb93ea92f04d12c3fa63e700cfe794ab6f20ae19f8ccbef80f2d4ce474a938cd471f1407c8f3463dc3fa9f4f300a792e7a425141a6cfbfd3a69c0"
        }
      ],
      "purl": "pkg:npm/@trufflesuite/uws-js-unofficial@20.30.0",
      "type": "library",
      "bom-ref": "pkg:npm/@trufflesuite/uws-js-unofficial@20.30.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/@trufflesuite/uws-js-unofficial/-/uws-js-unofficial-20.30.0-unofficial.0.tgz"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "runtime"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.0"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@trufflesuite/uws-js-unofficial@20.30.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40trufflesuite%2Fuws-js-unofficial/20.30.0-unofficial.0"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.0,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "tags": [
        "native"
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ]
    },
    {
      "group": "",
      "name": "bufferutil",
      "version": "4.0.7",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "92e92ea9cdfd58e1ed771b70e1449cc45fd65673055524152a1b71dc08d927385dd1119966575cadf4846d5b1659ee8a347db9df9ef872ae45fb0a6fd06f6927"
        }
      ],
      "purl": "pkg:npm/bufferutil@4.0.7",
      "type": "library",
      "bom-ref": "pkg:npm/bufferutil@4.0.7",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/bufferutil/-/bufferutil-4.0.7.tgz"
        },
        {
          "name": "cdx:npm:hasInstallScript",
          "value": "true"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.0"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/bufferutil@4.0.7\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/bufferutil/4.0.7"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.0,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "group": "",
      "name": "utf-8-validate",
      "version": "6.0.3",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "b88b867fd4d643fcbed0ba7e28664232e25673737d04703e97f5261ddfe8507c092437b2b324d1c4d41591bcec2167c615b45edce72030bfe2d26bd544f3b20c"
        }
      ],
      "purl": "pkg:npm/utf-8-validate@6.0.3",
      "type": "library",
      "bom-ref": "pkg:npm/utf-8-validate@6.0.3",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/utf-8-validate/-/utf-8-validate-6.0.3.tgz"
        },
        {
          "name": "cdx:npm:hasInstallScript",
          "value": "true"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.0"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/utf-8-validate@6.0.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/utf-8-validate/6.0.3"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "package-lock.json"
              }
            ],
            "concludedValue": "package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.0,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "group": "@types",
      "name": "@types/seedrandom",
      "version": "3.0.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "82207d8330de8827a5a085c38331410a08e3d64e16c5c0eb66d1a5ea1d48aa650f97117e371f157bef7a402c8367f1ec781feebc3b0a6e989bf61539714e77a7"
        }
      ],
      "purl": "pkg:npm/@types/seedrandom@3.0.1",
      "type": "library",
      "bom-ref": "pkg:npm/@types/seedrandom@3.0.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/@types/seedrandom/-/seedrandom-3.0.1.tgz"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.0"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/@types/seedrandom@3.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"library_metadata_db\", \"supplier\": \"DefinitelyTyped Contributors\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/%40types%2Fseedrandom/3.0.1"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.0,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "DefinitelyTyped Contributors",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "group": "",
      "name": "abstract-level",
      "version": "1.0.3",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "b7a8effb11f2f95630738c6a64c9f63daf438dc773bf36664064634c573cb2921b4461e006b10a6cfabead85dcec20a8d25c6062f4a029583da99021a554128c"
        }
      ],
      "purl": "pkg:npm/abstract-level@1.0.3",
      "type": "library",
      "bom-ref": "pkg:npm/abstract-level@1.0.3",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/abstract-level/-/abstract-level-1.0.3.tgz"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.0"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/abstract-level@1.0.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/abstract-level/1.0.3"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.0,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "group": "",
      "name": "buffer",
      "version": "6.0.3",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "153882a4dc6dc226591c465b71b4c87198c44552029fdcaafe90c591397de7f031cc3d6768172d37b60eebcae233f80b48363bb1dacc6f2f21a1f00362ebaa38"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/buffer@6.0.3",
      "type": "library",
      "bom-ref": "pkg:npm/buffer@6.0.3",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/buffer/-/buffer-6.0.3.tgz"
        },
        {
          "name": "cdx:npm:inBundle",
          "value": "true"
        },
        {
          "name": "cdx:npm:inDepBundle",
          "value": "true"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/buffer@6.0.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "base64-js",
      "version": "1.5.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "00aa5a6251e7f2de1255b3870b2f9be7e28a82f478bebb03f2f6efadb890269b3b7ca0d3923903af2ea38b4ad42630b49336cd78f2f0cf1abc8b2a68e35a9e58"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/base64-js@1.5.1",
      "type": "library",
      "bom-ref": "pkg:npm/base64-js@1.5.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz"
        },
        {
          "name": "cdx:npm:inBundle",
          "value": "true"
        },
        {
          "name": "cdx:npm:inDepBundle",
          "value": "true"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/base64-js@1.5.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "ieee754",
      "version": "1.2.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "75ccaa843bd7d42e3a95765c56a0a92be16d31141574830debf0dfe63b36ce8b94b2a1bb23ab05c62b480beeca60adbd29d5ce2c776ef732f8b059e85509ea68"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "BSD-3-Clause",
            "url": "https://opensource.org/licenses/BSD-3-Clause"
          }
        }
      ],
      "purl": "pkg:npm/ieee754@1.2.1",
      "type": "library",
      "bom-ref": "pkg:npm/ieee754@1.2.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz"
        },
        {
          "name": "cdx:npm:inBundle",
          "value": "true"
        },
        {
          "name": "cdx:npm:inDepBundle",
          "value": "true"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/ieee754@1.2.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "catering",
      "version": "2.1.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "2bb432f0ef69efab0bdffde6effccb29b464c8e95264083311a2e1ca3da65d2f0fb02b9dd84a388406fc68bb59a87874406a8b71bf5d9494aeea51d1544366d7"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/catering@2.1.1",
      "type": "library",
      "bom-ref": "pkg:npm/catering@2.1.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/catering/-/catering-2.1.1.tgz"
        },
        {
          "name": "cdx:npm:inBundle",
          "value": "true"
        },
        {
          "name": "cdx:npm:inDepBundle",
          "value": "true"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/catering@2.1.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "is-buffer",
      "version": "2.0.5",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "8b647accd143c20107272414b49124d17162d62d1d3c59ffa2a8cadffbcf09c0de26f5b9350f3757c41b89c7c5d52ba939a07487c9ed8010b662213b75fc9cb5"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/is-buffer@2.0.5",
      "type": "library",
      "bom-ref": "pkg:npm/is-buffer@2.0.5",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/is-buffer/-/is-buffer-2.0.5.tgz"
        },
        {
          "name": "cdx:npm:inBundle",
          "value": "true"
        },
        {
          "name": "cdx:npm:inDepBundle",
          "value": "true"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/is-buffer@2.0.5\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "level-supports",
      "version": "4.0.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "3db5e9bdef2b29e35c67d0b599489c0bd6ae2181721a9915f7f8ba83bead2e000dc1686d1b6bfb238c4d0549649f7944dbf7591773e2d328181ad2dce115d774"
        }
      ],
      "purl": "pkg:npm/level-supports@4.0.1",
      "type": "library",
      "bom-ref": "pkg:npm/level-supports@4.0.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/level-supports/-/level-supports-4.0.1.tgz"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.0"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/level-supports@4.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/level-supports/4.0.1"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.0,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "group": "",
      "name": "level-transcoder",
      "version": "1.0.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "b7b6c5c05b6c41e0fc725f0d2284368b0c40d022fff48170efff600233a89c7d0f5934e245f63b1eaf848dbb3187cead5e86c343a20e89d76335821f381b34eb"
        }
      ],
      "purl": "pkg:npm/level-transcoder@1.0.1",
      "type": "library",
      "bom-ref": "pkg:npm/level-transcoder@1.0.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/level-transcoder/-/level-transcoder-1.0.1.tgz"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.0"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/level-transcoder@1.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/level-transcoder/1.0.1"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.0,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "group": "",
      "name": "module-error",
      "version": "1.0.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "d32bafb2a482bfc2db68e2a19ec43f4f9261c8594260b3d72b7536b20575d33a0a430cecfccc9fb9050e650d55ffa382389b0afd3460355acfb8f0eab5d305b4"
        }
      ],
      "purl": "pkg:npm/module-error@1.0.2",
      "type": "library",
      "bom-ref": "pkg:npm/module-error@1.0.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/module-error/-/module-error-1.0.2.tgz"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.0"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/module-error@1.0.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/module-error/1.0.2"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.0,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "group": "",
      "name": "queue-microtask",
      "version": "1.2.3",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "36e68d49ae9f94a4f925a498433268934e09cd32f5080e9a1a1bf9adf2d6dcf82a03e3360a1a59427002f21f22e19164052f17e51aa40c11c0eebe217a3dcaf4"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/queue-microtask@1.2.3",
      "type": "library",
      "bom-ref": "pkg:npm/queue-microtask@1.2.3",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz"
        },
        {
          "name": "cdx:npm:inBundle",
          "value": "true"
        },
        {
          "name": "cdx:npm:inDepBundle",
          "value": "true"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/queue-microtask@1.2.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"Feross Aboukhadijeh\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "Feross Aboukhadijeh",
        "url": [
          "https://github.com/feross/queue-microtask"
        ]
      }
    },
    {
      "group": "",
      "name": "level-concat-iterator",
      "version": "3.1.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "0564423070716c8a8fc49f2f1cebca52c68ed2fd6c2d866d8cddcada2649b11058b69f8e36c63a25f8ba872f4adfece8960411af28489f6351663667589f4d99"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/level-concat-iterator@3.1.0",
      "type": "library",
      "bom-ref": "pkg:npm/level-concat-iterator@3.1.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/level-concat-iterator/-/level-concat-iterator-3.1.0.tgz"
        },
        {
          "name": "cdx:npm:inBundle",
          "value": "true"
        },
        {
          "name": "cdx:npm:inDepBundle",
          "value": "true"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/level-concat-iterator@3.1.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "async-eventemitter",
      "version": "0.2.4",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "a5ddb40702fb62dd73c03172fbc317f05d7e5824fc69078a8f49109d3ac7f5669e4444e545a995843d09b513e6ad5e067ce27617d0af7509197998678764ee1f"
        }
      ],
      "purl": "pkg:npm/async-eventemitter@0.2.4",
      "type": "library",
      "bom-ref": "pkg:npm/async-eventemitter@0.2.4",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/async-eventemitter/-/async-eventemitter-0.2.4.tgz"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.0"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/async-eventemitter@0.2.4\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/async-eventemitter/0.2.4"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.0,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "Unknown",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "group": "",
      "name": "async",
      "version": "2.6.4",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "9b3a3975f258c009f6f4f7a2274cefc13a34e338fc1c3263d0c9fc4c3eec9e8eead76a6b75b9dab0a2478649b67352e0ae1949d2d79a79af3ceb4a318b9d6618"
        }
      ],
      "purl": "pkg:npm/async@2.6.4",
      "type": "library",
      "bom-ref": "pkg:npm/async@2.6.4",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/async/-/async-2.6.4.tgz"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/async@2.6.4\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"known_maintainer\", \"supplier\": \"Caolan McMahon\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "Caolan McMahon",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ]
    },
    {
      "group": "",
      "name": "lodash",
      "version": "4.17.21",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "bf690311ee7b95e713ba568322e3533f2dd1cb880b189e99d4edef13592b81764daec43e2c54c61d5c558dc5cfb35ecb85b65519e74026ff17675b6f8f916f4a"
        }
      ],
      "purl": "pkg:npm/lodash@4.17.21",
      "type": "library",
      "bom-ref": "pkg:npm/lodash@4.17.21",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/lodash@4.17.21\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"known_maintainer\", \"supplier\": \"Lodash Contributors\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "Lodash Contributors",
        "url": []
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ]
    },
    {
      "group": "",
      "name": "emittery",
      "version": "0.10.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "006bc57ecf9dd09282250e28d3501240b18f9920b181f53d4455efccfbd976328af28b1cca792cb89856ad24d2c3b8fb129fec65cb796f96616028bc4bfb741d"
        }
      ],
      "purl": "pkg:npm/emittery@0.10.0",
      "type": "library",
      "bom-ref": "pkg:npm/emittery@0.10.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/emittery/-/emittery-0.10.0.tgz"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:license_source",
          "value": "npm"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/emittery@0.10.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://spdx.org/licenses/MIT.html"
          }
        }
      ]
    },
    {
      "group": "",
      "name": "keccak",
      "version": "3.0.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "3f228a8e41f9df00cc2c6aef9911923568264b164e52a6e75f028bf6d9a06c5600d62018a96db591f47b9995d5d0c9444a279fc50404f57f5f4dadd7fb630f0d"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/keccak@3.0.2",
      "type": "library",
      "bom-ref": "pkg:npm/keccak@3.0.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/keccak/-/keccak-3.0.2.tgz"
        },
        {
          "name": "cdx:npm:hasInstallScript",
          "value": "true"
        },
        {
          "name": "cdx:npm:inBundle",
          "value": "true"
        },
        {
          "name": "cdx:npm:inDepBundle",
          "value": "true"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/keccak@3.0.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "node-addon-api",
      "version": "2.0.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "36dcade00217c9a2c8b8c1c5e883a84da901dcaf915b1c2db07351c65944a00eaf3f03fda38f3aea0e985832d4767b9c8a56619a4c621f01ebd7580010dc3e40"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/node-addon-api@2.0.2",
      "type": "library",
      "bom-ref": "pkg:npm/node-addon-api@2.0.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-2.0.2.tgz"
        },
        {
          "name": "cdx:npm:inBundle",
          "value": "true"
        },
        {
          "name": "cdx:npm:inDepBundle",
          "value": "true"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/node-addon-api@2.0.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "readable-stream",
      "version": "3.6.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "055887cbb2ca793cf8a0d9e470b27e95548beafa6215e5fafddde8487f33096ed4c4fda89dc864faf4c6075e37c6e1631d2ddd7938242a85d7ca65eaca688874"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/readable-stream@3.6.0",
      "type": "library",
      "bom-ref": "pkg:npm/readable-stream@3.6.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.0.tgz"
        },
        {
          "name": "cdx:npm:inBundle",
          "value": "true"
        },
        {
          "name": "cdx:npm:inDepBundle",
          "value": "true"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/readable-stream@3.6.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "inherits",
      "version": "2.0.4",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "93fbc6697e3f6256b75b3c8c0af4d039761e207bea38ab67a8176ecd31e9ce9419cc0b2428c859d8af849c189233dcc64a820578ca572b16b8758799210a9ec1"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://opensource.org/licenses/ISC"
          }
        }
      ],
      "purl": "pkg:npm/inherits@2.0.4",
      "type": "library",
      "bom-ref": "pkg:npm/inherits@2.0.4",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz"
        },
        {
          "name": "cdx:npm:inBundle",
          "value": "true"
        },
        {
          "name": "cdx:npm:inDepBundle",
          "value": "true"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/inherits@2.0.4\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"registry_cache:npm_registry\", \"supplier\": \"isaacs\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "isaacs",
        "url": [
          "https://github.com/isaacs/inherits#readme"
        ]
      }
    },
    {
      "group": "",
      "name": "string_decoder",
      "version": "1.3.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "864457f14d568c915df0bb03276c90ff0596c5aa2912c0015355df90cf00fa3d3ef392401a9a6dd7a72bd56860e8a21b6f8a2453a32a97a04e8febaea7fc0a78"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/string_decoder@1.3.0",
      "type": "library",
      "bom-ref": "pkg:npm/string_decoder@1.3.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz"
        },
        {
          "name": "cdx:npm:inBundle",
          "value": "true"
        },
        {
          "name": "cdx:npm:inDepBundle",
          "value": "true"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/string_decoder@1.3.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "safe-buffer",
      "version": "5.2.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "ae9dd2a34eca71d9a629b1af81a37141226bedb1954959394bd12ad45fa9a5b468ef4f9879a0f1930e4377c34f37e183e9b8e7626d95b8fb825e6a6e62f9825d"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/safe-buffer@5.2.1",
      "type": "library",
      "bom-ref": "pkg:npm/safe-buffer@5.2.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz"
        },
        {
          "name": "cdx:npm:inBundle",
          "value": "true"
        },
        {
          "name": "cdx:npm:inDepBundle",
          "value": "true"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/safe-buffer@5.2.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "util-deprecate",
      "version": "1.0.2",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "450d4dc9fa70de732762fbd2d4a28981419a0ccf"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/util-deprecate@1.0.2",
      "type": "library",
      "bom-ref": "pkg:npm/util-deprecate@1.0.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz"
        },
        {
          "name": "cdx:npm:inBundle",
          "value": "true"
        },
        {
          "name": "cdx:npm:inDepBundle",
          "value": "true"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/util-deprecate@1.0.2\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "leveldown",
      "version": "6.1.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "f02ee82434f8e095f1874e1a492b1f70c23c62268646138523dfe93042fb9d624b56c59a8c33d3471b121d333659c4d56399d733e4ae447ccf3e2d066e70d7fb"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/leveldown@6.1.0",
      "type": "library",
      "bom-ref": "pkg:npm/leveldown@6.1.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/leveldown/-/leveldown-6.1.0.tgz"
        },
        {
          "name": "cdx:npm:hasInstallScript",
          "value": "true"
        },
        {
          "name": "cdx:npm:inBundle",
          "value": "true"
        },
        {
          "name": "cdx:npm:inDepBundle",
          "value": "true"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/leveldown@6.1.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "napi-macros",
      "version": "2.0.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "034c4bca41ed0117ee7884d50deae7b0059db4831b38980a81c96ec04369dc096c28dfcf968c8ed741ed9a8aa71404007313e481937bc1d7cf7c4774ccd1b16e"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/napi-macros@2.0.0",
      "type": "library",
      "bom-ref": "pkg:npm/napi-macros@2.0.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/napi-macros/-/napi-macros-2.0.0.tgz"
        },
        {
          "name": "cdx:npm:inBundle",
          "value": "true"
        },
        {
          "name": "cdx:npm:inDepBundle",
          "value": "true"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/napi-macros@2.0.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "secp256k1",
      "version": "4.0.3",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "34b6557fe44e331c2d123dd76b9eb6aa0bf604ae5ed963665cf88e75520f2e0b3a9724f332f06ad1a59360c2395c23fd8d931528e72a64bc3f59ce2f0e4bb184"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/secp256k1@4.0.3",
      "type": "library",
      "bom-ref": "pkg:npm/secp256k1@4.0.3",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/secp256k1/-/secp256k1-4.0.3.tgz"
        },
        {
          "name": "cdx:npm:hasInstallScript",
          "value": "true"
        },
        {
          "name": "cdx:npm:inBundle",
          "value": "true"
        },
        {
          "name": "cdx:npm:inDepBundle",
          "value": "true"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/secp256k1@4.0.3\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "elliptic",
      "version": "6.5.4",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "88b842e942de9ab9633d96fe42eb51e5340607ea5d5ba2860f94527a04bef2ca2b3994feadd4056ec405260bcddde46a3402ea25eaf8a10d7a62f247954f21cd"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/elliptic@6.5.4",
      "type": "library",
      "bom-ref": "pkg:npm/elliptic@6.5.4",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/elliptic/-/elliptic-6.5.4.tgz"
        },
        {
          "name": "cdx:npm:inBundle",
          "value": "true"
        },
        {
          "name": "cdx:npm:inDepBundle",
          "value": "true"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/elliptic@6.5.4\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "brorand",
      "version": "1.1.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "12c25efe40a45e3c323eb8675a0a0ce57b22371f"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/brorand@1.1.0",
      "type": "library",
      "bom-ref": "pkg:npm/brorand@1.1.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/brorand/-/brorand-1.1.0.tgz"
        },
        {
          "name": "cdx:npm:inBundle",
          "value": "true"
        },
        {
          "name": "cdx:npm:inDepBundle",
          "value": "true"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/brorand@1.1.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "Unknown",
        "url": []
      }
    },
    {
      "group": "",
      "name": "hash.js",
      "version": "1.1.7",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "b5a39ab241ade33e1238034db1e3af8980ef8c42629c8911826a7b2db28fd984d3995c56065f3bb3fbb32bdafee3805c9414a9d97ecad61a9e35fcfd25b05e5c"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/hash.js@1.1.7",
      "type": "library",
      "bom-ref": "pkg:npm/hash.js@1.1.7",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/hash.js/-/hash.js-1.1.7.tgz"
        },
        {
          "name": "cdx:npm:inBundle",
          "value": "true"
        },
        {
          "name": "cdx:npm:inDepBundle",
          "value": "true"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/hash.js@1.1.7\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "minimalistic-assert",
      "version": "1.0.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "52d25c003e3211a1ad8cf7b35ae3bdc02e27c149d51fff3f226df210740fe1bebb717943fd0afd85d213094d710db4845e0d9728d68ff23b11795eef41dd34fc"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "ISC",
            "url": "https://opensource.org/licenses/ISC"
          }
        }
      ],
      "purl": "pkg:npm/minimalistic-assert@1.0.1",
      "type": "library",
      "bom-ref": "pkg:npm/minimalistic-assert@1.0.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/minimalistic-assert/-/minimalistic-assert-1.0.1.tgz"
        },
        {
          "name": "cdx:npm:inBundle",
          "value": "true"
        },
        {
          "name": "cdx:npm:inDepBundle",
          "value": "true"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/minimalistic-assert@1.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "hmac-drbg",
      "version": "1.0.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d2745701025a6c775a6c545793ed502fc0c649a1"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/hmac-drbg@1.0.1",
      "type": "library",
      "bom-ref": "pkg:npm/hmac-drbg@1.0.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/hmac-drbg/-/hmac-drbg-1.0.1.tgz"
        },
        {
          "name": "cdx:npm:inBundle",
          "value": "true"
        },
        {
          "name": "cdx:npm:inDepBundle",
          "value": "true"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/hmac-drbg@1.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "minimalistic-crypto-utils",
      "version": "1.0.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f6c00c1c0b082246e5c4d99dfb8c7c083b2b582a"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/minimalistic-crypto-utils@1.0.1",
      "type": "library",
      "bom-ref": "pkg:npm/minimalistic-crypto-utils@1.0.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/minimalistic-crypto-utils/-/minimalistic-crypto-utils-1.0.1.tgz"
        },
        {
          "name": "cdx:npm:inBundle",
          "value": "true"
        },
        {
          "name": "cdx:npm:inDepBundle",
          "value": "true"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "unreachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Not imported by first-party source and not reachable from any imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/minimalistic-crypto-utils@1.0.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "tags": [
        "crypto"
      ],
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "solc",
      "version": "0.8.37",
      "scope": "required",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "89e51874f0d118d28cb19a427e2f6d63ae10f804a82fcb7284bbaf7fd7058aa0ecfba8a3971f169f60918b437bd40942bd1c74574f76ae5518bb76f73eec5694"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/solc@0.8.37",
      "type": "library",
      "bom-ref": "pkg:npm/solc@0.8.37",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/solc/-/solc-0.8.37.tgz"
        },
        {
          "name": "ImportedModules",
          "value": "solc"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Imported directly by first-party source code"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/solc@0.8.37\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ],
        "occurrences": [
          {
            "location": "scripts\\evm.mjs#6"
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "command-exists",
      "version": "1.2.9",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "2d343f48673eb345dcd05bb959a2a7474622ca06649bd78a16fc92f9f46c53bfd958517cca414ce8f73d68255fd7ec5ab0e399a4edc1015815acabeca8a1d5ef"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/command-exists@1.2.9",
      "type": "library",
      "bom-ref": "pkg:npm/command-exists@1.2.9",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/command-exists/-/command-exists-1.2.9.tgz"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/command-exists@1.2.9\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "follow-redirects",
      "version": "1.16.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "cb9acdfee3ac69d153fc97d8c21c514b947b41c7be837cc6f7bf89aed159942f64957fd6e610fb8a22f349c2389d9a944bb0cd51d84f830e3123c5b62ee5e553"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/follow-redirects@1.16.0",
      "type": "library",
      "bom-ref": "pkg:npm/follow-redirects@1.16.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/follow-redirects@1.16.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "js-sha3",
      "version": "0.8.0",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "805d5c46b1e123335f4e873cd363fcd3437c3e95d2f9ebcb2d77ec569a30aa600547dbb06e2f3d5af5e0d90b293a65cbf102fce89e13d44a45bbec94930258dd"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/js-sha3@0.8.0",
      "type": "library",
      "bom-ref": "pkg:npm/js-sha3@0.8.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/js-sha3/-/js-sha3-0.8.0.tgz"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/js-sha3@0.8.0\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    },
    {
      "group": "",
      "name": "memorystream",
      "version": "0.3.1",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "4b7530337ca3e66b544847cfe355199adff4482a15614714d6b917bfe050e4883c9dd2f8b0fa0934150911169f74f6f98e31c91ae320cad80abca21fe7c5cd07"
        }
      ],
      "purl": "pkg:npm/memorystream@0.3.1",
      "type": "library",
      "bom-ref": "pkg:npm/memorystream@0.3.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/memorystream/-/memorystream-0.3.1.tgz"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.0"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/memorystream@0.3.1\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        },
        {
          "name": "esl:license_source",
          "value": "https://registry.npmjs.org/memorystream/0.3.1"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.0,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "group": "",
      "name": "tmp",
      "version": "0.2.6",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "e6c24f74f8df2392b1faa6eb0deb319209510715bffe0ee10acaaca448f091ec06bc130620a30e4caccbb75845549cf269d6dade50d4376d0ef6a86f6d05124c"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/tmp@0.2.6",
      "type": "library",
      "bom-ref": "pkg:npm/tmp@0.2.6",
      "properties": [
        {
          "name": "SrcFile",
          "value": "package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/tmp/-/tmp-0.2.6.tgz"
        },
        {
          "name": "SrcFile",
          "value": "runs\\sbom-input\\package-lock.json"
        },
        {
          "name": "esl:foundBy",
          "value": "cdxgen"
        },
        {
          "name": "esl:support_status",
          "value": "unknown"
        },
        {
          "name": "esl:lifecycle_data_source",
          "value": "offline-skipped"
        },
        {
          "name": "esl:scope",
          "value": "build"
        },
        {
          "name": "esl:scope_source",
          "value": "package-lock.json dependency metadata"
        },
        {
          "name": "esl:reachability",
          "value": "reachable"
        },
        {
          "name": "esl:reachability_evidence",
          "value": "Reachable transitively from an imported package via the dependency graph"
        },
        {
          "name": "esl:version_source",
          "value": "cataloger_pin"
        },
        {
          "name": "esl:confidence",
          "value": "0.1"
        },
        {
          "name": "esl:confidence_band",
          "value": "low"
        },
        {
          "name": "esl:adoption",
          "value": "{\"package_created_at\": null, \"package_profile\": \"unknown\", \"publisher_changed\": \"unknown\", \"purl\": \"pkg:npm/tmp@0.2.6\", \"signals\": [{\"code\": \"not_evaluated\", \"message\": \"Registry publication evidence not evaluated\", \"severity\": \"Info\"}], \"status\": \"not_evaluated\", \"version_age_hours\": null, \"version_published_at\": null}"
        },
        {
          "name": "esl:version_published_at",
          "value": "unknown"
        },
        {
          "name": "esl:version_age_hours",
          "value": "unknown"
        },
        {
          "name": "esl:package_created_at",
          "value": "unknown"
        },
        {
          "name": "esl:package_profile",
          "value": "unknown"
        },
        {
          "name": "esl:publisher_changed",
          "value": "unknown"
        },
        {
          "name": "esl:supply_chain_signal",
          "value": "not_evaluated"
        },
        {
          "name": "esl:cve_analysis",
          "value": "scanned_clean"
        },
        {
          "name": "esl:cve_analysis_reason",
          "value": "queried by configured ecosystem scanner(s); no CVE for this version"
        },
        {
          "name": "esl:component:esl_vendor_info",
          "value": "{\"confidence\": \"high\", \"source_type\": \"ecosystem\", \"supplier\": \"npm Community\"}"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 1,
                "value": "runs\\sbom-input\\package-lock.json"
              }
            ],
            "concludedValue": "runs\\sbom-input\\package-lock.json"
          },
          {
            "field": "name",
            "confidence": 0.1,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.6,
                "value": "detected by cdxgen"
              }
            ]
          }
        ]
      },
      "supplier": {
        "name": "npm Community",
        "url": [
          "https://www.npmjs.com"
        ]
      }
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "GHSA-378v-28hj-76wf-pkg:npm/bn.js@4.12.0",
      "id": "GHSA-378V-28HJ-76WF",
      "affects": [
        {
          "ref": "pkg:npm/bn.js@4.12.0"
        }
      ],
      "source": {
        "name": "OSV",
        "url": "https://osv.dev/vulnerability/GHSA-378v-28hj-76wf"
      },
      "ratings": [
        {
          "source": {
            "name": "OSV"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "other"
        }
      ],
      "description": "bn.js affected by an infinite loop",
      "published": "2026-02-20T06:30:39Z",
      "properties": [
        {
          "name": "esl:vulnerability_alias",
          "value": "GHSA-378v-28hj-76wf"
        },
        {
          "name": "esl:earliest_public_at",
          "value": "2026-02-20T06:30:39Z"
        },
        {
          "name": "esl:earliest_source",
          "value": "ghsa"
        },
        {
          "name": "esl:disclosure_lag_days",
          "value": ""
        },
        {
          "name": "esl:response_due_at",
          "value": "2026-03-06T06:30:39Z"
        },
        {
          "name": "esl:response_status",
          "value": "not_applicable"
        },
        {
          "name": "esl:fix_available",
          "value": "unknown"
        },
        {
          "name": "esl:fix_fixed_versions",
          "value": "[]"
        },
        {
          "name": "esl:fix_recommended_version",
          "value": ""
        },
        {
          "name": "esl:fix_recommended_is_major_bump",
          "value": "false"
        },
        {
          "name": "esl:fix_first_available_at",
          "value": ""
        },
        {
          "name": "esl:remediation_age_days",
          "value": ""
        },
        {
          "name": "esl:fix_sources",
          "value": "[]"
        },
        {
          "name": "esl:fix_reason",
          "value": "registry_not_evaluated"
        },
        {
          "name": "esl:cve_year",
          "value": ""
        },
        {
          "name": "esl:age_days",
          "value": "212"
        },
        {
          "name": "esl:dormant",
          "value": "false"
        },
        {
          "name": "esl:vulnerability:ecosystem",
          "value": "npm"
        }
      ],
      "updated": "2026-09-10T03:50:33.815513385Z"
    },
    {
      "bom-ref": "GHSA-378v-28hj-76wf-pkg:npm/bn.js@5.2.1",
      "id": "GHSA-378V-28HJ-76WF",
      "affects": [
        {
          "ref": "pkg:npm/bn.js@5.2.1"
        }
      ],
      "source": {
        "name": "OSV",
        "url": "https://osv.dev/vulnerability/GHSA-378v-28hj-76wf"
      },
      "ratings": [
        {
          "source": {
            "name": "OSV"
          },
          "score": 5.3,
          "severity": "medium",
          "method": "other"
        }
      ],
      "description": "bn.js affected by an infinite loop",
      "published": "2026-02-20T06:30:39Z",
      "properties": [
        {
          "name": "esl:vulnerability_alias",
          "value": "GHSA-378v-28hj-76wf"
        },
        {
          "name": "esl:earliest_public_at",
          "value": "2026-02-20T06:30:39Z"
        },
        {
          "name": "esl:earliest_source",
          "value": "ghsa"
        },
        {
          "name": "esl:disclosure_lag_days",
          "value": ""
        },
        {
          "name": "esl:response_due_at",
          "value": "2026-03-06T06:30:39Z"
        },
        {
          "name": "esl:response_status",
          "value": "not_applicable"
        },
        {
          "name": "esl:fix_available",
          "value": "unknown"
        },
        {
          "name": "esl:fix_fixed_versions",
          "value": "[]"
        },
        {
          "name": "esl:fix_recommended_version",
          "value": ""
        },
        {
          "name": "esl:fix_recommended_is_major_bump",
          "value": "false"
        },
        {
          "name": "esl:fix_first_available_at",
          "value": ""
        },
        {
          "name": "esl:remediation_age_days",
          "value": ""
        },
        {
          "name": "esl:fix_sources",
          "value": "[]"
        },
        {
          "name": "esl:fix_reason",
          "value": "registry_not_evaluated"
        },
        {
          "name": "esl:cve_year",
          "value": ""
        },
        {
          "name": "esl:age_days",
          "value": "212"
        },
        {
          "name": "esl:dormant",
          "value": "false"
        },
        {
          "name": "esl:vulnerability:ecosystem",
          "value": "npm"
        }
      ],
      "updated": "2026-09-10T03:50:33.815513385Z"
    },
    {
      "bom-ref": "GHSA-5c6j-r48x-rmvq-pkg:npm/serialize-javascript@6.0.0",
      "id": "GHSA-5C6J-R48X-RMVQ",
      "affects": [
        {
          "ref": "pkg:npm/serialize-javascript@6.0.0"
        }
      ],
      "source": {
        "name": "OSV",
        "url": "https://osv.dev/vulnerability/GHSA-5c6j-r48x-rmvq"
      },
      "ratings": [
        {
          "source": {
            "name": "OSV"
          },
          "score": 8.1,
          "severity": "high",
          "method": "other"
        }
      ],
      "description": "Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()",
      "published": "2026-02-28T02:50:45Z",
      "properties": [
        {
          "name": "esl:vulnerability_alias",
          "value": "GHSA-5c6j-r48x-rmvq"
        },
        {
          "name": "esl:earliest_public_at",
          "value": "2026-02-28T02:50:45Z"
        },
        {
          "name": "esl:earliest_source",
          "value": "ghsa"
        },
        {
          "name": "esl:disclosure_lag_days",
          "value": ""
        },
        {
          "name": "esl:response_due_at",
          "value": "2026-03-14T02:50:45Z"
        },
        {
          "name": "esl:response_status",
          "value": "not_applicable"
        },
        {
          "name": "esl:fix_available",
          "value": "unknown"
        },
        {
          "name": "esl:fix_fixed_versions",
          "value": "[]"
        },
        {
          "name": "esl:fix_recommended_version",
          "value": ""
        },
        {
          "name": "esl:fix_recommended_is_major_bump",
          "value": "false"
        },
        {
          "name": "esl:fix_first_available_at",
          "value": ""
        },
        {
          "name": "esl:remediation_age_days",
          "value": ""
        },
        {
          "name": "esl:fix_sources",
          "value": "[]"
        },
        {
          "name": "esl:fix_reason",
          "value": "registry_not_evaluated"
        },
        {
          "name": "esl:cve_year",
          "value": ""
        },
        {
          "name": "esl:age_days",
          "value": "204"
        },
        {
          "name": "esl:dormant",
          "value": "false"
        },
        {
          "name": "esl:vulnerability:ecosystem",
          "value": "npm"
        }
      ],
      "updated": "2026-09-10T03:50:34.154574250Z"
    },
    {
      "bom-ref": "GHSA-hxcc-f52p-wc94-pkg:npm/serialize-javascript@6.0.0",
      "id": "GHSA-HXCC-F52P-WC94",
      "affects": [
        {
          "ref": "pkg:npm/serialize-javascript@6.0.0"
        }
      ],
      "source": {
        "name": "OSV",
        "url": "https://osv.dev/vulnerability/GHSA-hxcc-f52p-wc94"
      },
      "ratings": [
        {
          "source": {
            "name": "OSV"
          },
          "score": 8.1,
          "severity": "high",
          "method": "other"
        }
      ],
      "description": "Insecure serialization leading to RCE in serialize-javascript",
      "published": "2020-08-11T17:21:13Z",
      "properties": [
        {
          "name": "esl:vulnerability_alias",
          "value": "GHSA-hxcc-f52p-wc94"
        },
        {
          "name": "esl:earliest_public_at",
          "value": "2020-08-11T17:21:13Z"
        },
        {
          "name": "esl:earliest_source",
          "value": "ghsa"
        },
        {
          "name": "esl:disclosure_lag_days",
          "value": ""
        },
        {
          "name": "esl:response_due_at",
          "value": "2020-08-25T17:21:13Z"
        },
        {
          "name": "esl:response_status",
          "value": "not_applicable"
        },
        {
          "name": "esl:fix_available",
          "value": "unknown"
        },
        {
          "name": "esl:fix_fixed_versions",
          "value": "[]"
        },
        {
          "name": "esl:fix_recommended_version",
          "value": ""
        },
        {
          "name": "esl:fix_recommended_is_major_bump",
          "value": "false"
        },
        {
          "name": "esl:fix_first_available_at",
          "value": ""
        },
        {
          "name": "esl:remediation_age_days",
          "value": ""
        },
        {
          "name": "esl:fix_sources",
          "value": "[]"
        },
        {
          "name": "esl:fix_reason",
          "value": "registry_not_evaluated"
        },
        {
          "name": "esl:cve_year",
          "value": ""
        },
        {
          "name": "esl:age_days",
          "value": "2230"
        },
        {
          "name": "esl:dormant",
          "value": "false"
        },
        {
          "name": "esl:vulnerability:ecosystem",
          "value": "npm"
        }
      ],
      "updated": "2023-11-08T04:04:03.301649Z"
    },
    {
      "bom-ref": "GHSA-qj8w-gfj5-8c6v-pkg:npm/serialize-javascript@6.0.0",
      "id": "GHSA-QJ8W-GFJ5-8C6V",
      "affects": [
        {
          "ref": "pkg:npm/serialize-javascript@6.0.0"
        }
      ],
      "source": {
        "name": "OSV",
        "url": "https://osv.dev/vulnerability/GHSA-qj8w-gfj5-8c6v"
      },
      "ratings": [
        {
          "source": {
            "name": "OSV"
          },
          "score": 5.9,
          "severity": "medium",
          "method": "other"
        }
      ],
      "description": "Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects",
      "published": "2026-03-27T18:18:54Z",
      "properties": [
        {
          "name": "esl:vulnerability_alias",
          "value": "GHSA-qj8w-gfj5-8c6v"
        },
        {
          "name": "esl:earliest_public_at",
          "value": "2026-03-27T18:18:54Z"
        },
        {
          "name": "esl:earliest_source",
          "value": "ghsa"
        },
        {
          "name": "esl:disclosure_lag_days",
          "value": ""
        },
        {
          "name": "esl:response_due_at",
          "value": "2026-04-10T18:18:54Z"
        },
        {
          "name": "esl:response_status",
          "value": "not_applicable"
        },
        {
          "name": "esl:fix_available",
          "value": "unknown"
        },
        {
          "name": "esl:fix_fixed_versions",
          "value": "[]"
        },
        {
          "name": "esl:fix_recommended_version",
          "value": ""
        },
        {
          "name": "esl:fix_recommended_is_major_bump",
          "value": "false"
        },
        {
          "name": "esl:fix_first_available_at",
          "value": ""
        },
        {
          "name": "esl:remediation_age_days",
          "value": ""
        },
        {
          "name": "esl:fix_sources",
          "value": "[]"
        },
        {
          "name": "esl:fix_reason",
          "value": "registry_not_evaluated"
        },
        {
          "name": "esl:cve_year",
          "value": ""
        },
        {
          "name": "esl:age_days",
          "value": "176"
        },
        {
          "name": "esl:dormant",
          "value": "false"
        },
        {
          "name": "esl:vulnerability:ecosystem",
          "value": "npm"
        }
      ],
      "updated": "2026-09-10T03:50:40.557735802Z"
    },
    {
      "bom-ref": "GHSA-76p7-773f-r4q5-pkg:npm/serialize-javascript@6.0.0",
      "id": "GHSA-76P7-773F-R4Q5",
      "affects": [
        {
          "ref": "pkg:npm/serialize-javascript@6.0.0"
        }
      ],
      "source": {
        "name": "OSV",
        "url": "https://osv.dev/vulnerability/GHSA-76p7-773f-r4q5"
      },
      "ratings": [
        {
          "source": {
            "name": "OSV"
          },
          "score": 5.4,
          "severity": "medium",
          "method": "other"
        }
      ],
      "description": "Cross-site Scripting (XSS) in serialize-javascript",
      "published": "2025-02-10T18:30:47Z",
      "properties": [
        {
          "name": "esl:vulnerability_alias",
          "value": "GHSA-76p7-773f-r4q5"
        },
        {
          "name": "esl:earliest_public_at",
          "value": "2025-02-10T18:30:47Z"
        },
        {
          "name": "esl:earliest_source",
          "value": "ghsa"
        },
        {
          "name": "esl:disclosure_lag_days",
          "value": ""
        },
        {
          "name": "esl:response_due_at",
          "value": "2025-02-24T18:30:47Z"
        },
        {
          "name": "esl:response_status",
          "value": "not_applicable"
        },
        {
          "name": "esl:fix_available",
          "value": "unknown"
        },
        {
          "name": "esl:fix_fixed_versions",
          "value": "[]"
        },
        {
          "name": "esl:fix_recommended_version",
          "value": ""
        },
        {
          "name": "esl:fix_recommended_is_major_bump",
          "value": "false"
        },
        {
          "name": "esl:fix_first_available_at",
          "value": ""
        },
        {
          "name": "esl:remediation_age_days",
          "value": ""
        },
        {
          "name": "esl:fix_sources",
          "value": "[]"
        },
        {
          "name": "esl:fix_reason",
          "value": "registry_not_evaluated"
        },
        {
          "name": "esl:cve_year",
          "value": ""
        },
        {
          "name": "esl:age_days",
          "value": "586"
        },
        {
          "name": "esl:dormant",
          "value": "false"
        },
        {
          "name": "esl:vulnerability:ecosystem",
          "value": "npm"
        }
      ],
      "updated": "2026-09-10T03:50:22.423877607Z"
    },
    {
      "bom-ref": "GHSA-h9rv-jmmf-4pgx-pkg:npm/serialize-javascript@6.0.0",
      "id": "GHSA-H9RV-JMMF-4PGX",
      "affects": [
        {
          "ref": "pkg:npm/serialize-javascript@6.0.0"
        }
      ],
      "source": {
        "name": "OSV",
        "url": "https://osv.dev/vulnerability/GHSA-h9rv-jmmf-4pgx"
      },
      "ratings": [
        {
          "source": {
            "name": "OSV"
          },
          "score": 4.2,
          "severity": "medium",
          "method": "other"
        }
      ],
      "description": "Cross-Site Scripting in serialize-javascript",
      "published": "2019-12-05T18:44:37Z",
      "properties": [
        {
          "name": "esl:vulnerability_alias",
          "value": "GHSA-h9rv-jmmf-4pgx"
        },
        {
          "name": "esl:earliest_public_at",
          "value": "2019-12-05T18:44:37Z"
        },
        {
          "name": "esl:earliest_source",
          "value": "ghsa"
        },
        {
          "name": "esl:disclosure_lag_days",
          "value": ""
        },
        {
          "name": "esl:response_due_at",
          "value": "2019-12-19T18:44:37Z"
        },
        {
          "name": "esl:response_status",
          "value": "not_applicable"
        },
        {
          "name": "esl:fix_available",
          "value": "unknown"
        },
        {
          "name": "esl:fix_fixed_versions",
          "value": "[]"
        },
        {
          "name": "esl:fix_recommended_version",
          "value": ""
        },
        {
          "name": "esl:fix_recommended_is_major_bump",
          "value": "false"
        },
        {
          "name": "esl:fix_first_available_at",
          "value": ""
        },
        {
          "name": "esl:remediation_age_days",
          "value": ""
        },
        {
          "name": "esl:fix_sources",
          "value": "[]"
        },
        {
          "name": "esl:fix_reason",
          "value": "registry_not_evaluated"
        },
        {
          "name": "esl:cve_year",
          "value": ""
        },
        {
          "name": "esl:age_days",
          "value": "2480"
        },
        {
          "name": "esl:dormant",
          "value": "false"
        },
        {
          "name": "esl:vulnerability:ecosystem",
          "value": "npm"
        }
      ],
      "updated": "2026-09-10T03:49:24.747348522Z"
    },
    {
      "bom-ref": "GHSA-95m3-7q98-8xr5-pkg:npm/sha.js@2.4.11",
      "id": "GHSA-95M3-7Q98-8XR5",
      "affects": [
        {
          "ref": "pkg:npm/sha.js@2.4.11"
        }
      ],
      "source": {
        "name": "OSV",
        "url": "https://osv.dev/vulnerability/GHSA-95m3-7q98-8xr5"
      },
      "ratings": [
        {
          "source": {
            "name": "OSV"
          },
          "score": 9.1,
          "severity": "critical",
          "method": "other"
        }
      ],
      "description": "sha.js is missing type checks leading to hash rewind and passing on crafted data",
      "published": "2025-08-21T14:47:55Z",
      "properties": [
        {
          "name": "esl:vulnerability_alias",
          "value": "GHSA-95m3-7q98-8xr5"
        },
        {
          "name": "esl:earliest_public_at",
          "value": "2025-08-21T14:47:55Z"
        },
        {
          "name": "esl:earliest_source",
          "value": "ghsa"
        },
        {
          "name": "esl:disclosure_lag_days",
          "value": ""
        },
        {
          "name": "esl:response_due_at",
          "value": "2025-09-04T14:47:55Z"
        },
        {
          "name": "esl:response_status",
          "value": "not_applicable"
        },
        {
          "name": "esl:fix_available",
          "value": "unknown"
        },
        {
          "name": "esl:fix_fixed_versions",
          "value": "[]"
        },
        {
          "name": "esl:fix_recommended_version",
          "value": ""
        },
        {
          "name": "esl:fix_recommended_is_major_bump",
          "value": "false"
        },
        {
          "name": "esl:fix_first_available_at",
          "value": ""
        },
        {
          "name": "esl:remediation_age_days",
          "value": ""
        },
        {
          "name": "esl:fix_sources",
          "value": "[]"
        },
        {
          "name": "esl:fix_reason",
          "value": "registry_not_evaluated"
        },
        {
          "name": "esl:cve_year",
          "value": ""
        },
        {
          "name": "esl:age_days",
          "value": "394"
        },
        {
          "name": "esl:dormant",
          "value": "false"
        },
        {
          "name": "esl:vulnerability:ecosystem",
          "value": "npm"
        }
      ],
      "updated": "2026-09-10T03:50:26.795456685Z"
    }
  ],
  "dependencies": [
    {
      "ref": "urn:sbomator:product:MantiQ-Solidity@0.0.0+git.8ff48e7-dirty",
      "dependsOn": [
        "pkg:npm/@cspotcode/source-map-support@0.8.1",
        "pkg:npm/@discoveryjs/json-ext@0.5.7",
        "pkg:npm/@jridgewell/gen-mapping@0.3.2",
        "pkg:npm/@jridgewell/resolve-uri@3.1.0",
        "pkg:npm/@jridgewell/set-array@1.1.2",
        "pkg:npm/@jridgewell/source-map@0.3.2",
        "pkg:npm/@jridgewell/sourcemap-codec@1.4.14",
        "pkg:npm/@jridgewell/trace-mapping@0.3.17",
        "pkg:npm/@jridgewell/trace-mapping@0.3.9",
        "pkg:npm/@microsoft/api-extractor@7.20.1",
        "pkg:npm/@microsoft/api-extractor-model@7.16.0",
        "pkg:npm/@microsoft/tsdoc@0.13.2",
        "pkg:npm/@microsoft/tsdoc-config@0.15.2",
        "pkg:npm/@rushstack/node-core-library@3.45.1",
        "pkg:npm/@rushstack/rig-package@0.3.8",
        "pkg:npm/@rushstack/ts-command-line@4.10.7",
        "pkg:npm/@tsconfig/node10@1.0.9",
        "pkg:npm/@tsconfig/node12@1.0.11",
        "pkg:npm/@tsconfig/node14@1.0.3",
        "pkg:npm/@tsconfig/node16@1.0.3",
        "pkg:npm/@types/abstract-leveldown@7.2.0",
        "pkg:npm/@types/argparse@1.0.38",
        "pkg:npm/@types/eslint@8.4.10",
        "pkg:npm/@types/eslint-scope@3.7.4",
        "pkg:npm/@types/estree@0.0.50",
        "pkg:npm/@types/json-schema@7.0.11",
        "pkg:npm/@types/mocha@9.0.0",
        "pkg:npm/@types/node@12.20.24",
        "pkg:npm/@ungap/promise-all-settled@1.1.2",
        "pkg:npm/@webassemblyjs/ast@1.11.1",
        "pkg:npm/@webassemblyjs/floating-point-hex-parser@1.11.1",
        "pkg:npm/@webassemblyjs/helper-api-error@1.11.1",
        "pkg:npm/@webassemblyjs/helper-buffer@1.11.1",
        "pkg:npm/@webassemblyjs/helper-numbers@1.11.1",
        "pkg:npm/@webassemblyjs/helper-wasm-bytecode@1.11.1",
        "pkg:npm/@webassemblyjs/helper-wasm-section@1.11.1",
        "pkg:npm/@webassemblyjs/ieee754@1.11.1",
        "pkg:npm/@webassemblyjs/leb128@1.11.1",
        "pkg:npm/@webassemblyjs/utf8@1.11.1",
        "pkg:npm/@webassemblyjs/wasm-edit@1.11.1",
        "pkg:npm/@webassemblyjs/wasm-gen@1.11.1",
        "pkg:npm/@webassemblyjs/wasm-opt@1.11.1",
        "pkg:npm/@webassemblyjs/wasm-parser@1.11.1",
        "pkg:npm/@webassemblyjs/wast-printer@1.11.1",
        "pkg:npm/@webpack-cli/configtest@1.2.0",
        "pkg:npm/@webpack-cli/info@1.5.0",
        "pkg:npm/@webpack-cli/serve@1.7.0",
        "pkg:npm/@xtuc/ieee754@1.2.0",
        "pkg:npm/@xtuc/long@4.2.2",
        "pkg:npm/acorn@8.8.1",
        "pkg:npm/acorn-import-assertions@1.8.0",
        "pkg:npm/acorn-walk@8.2.0",
        "pkg:npm/ajv@6.12.6",
        "pkg:npm/ajv-keywords@3.5.2",
        "pkg:npm/ansi-colors@4.1.1",
        "pkg:npm/ansi-regex@5.0.1",
        "pkg:npm/ansi-styles@4.3.0",
        "pkg:npm/anymatch@3.1.3",
        "pkg:npm/arg@4.1.3",
        "pkg:npm/argparse@1.0.10",
        "pkg:npm/argparse@2.0.1",
        "pkg:npm/asn1.js@5.4.1",
        "pkg:npm/assert@2.0.0",
        "pkg:npm/available-typed-arrays@1.0.5",
        "pkg:npm/balanced-match@1.0.2",
        "pkg:npm/big.js@5.2.2",
        "pkg:npm/binary-extensions@2.2.0",
        "pkg:npm/bn.js@4.12.0",
        "pkg:npm/bn.js@5.2.1",
        "pkg:npm/brace-expansion@1.1.11",
        "pkg:npm/braces@3.0.2",
        "pkg:npm/browser-stdout@1.3.1",
        "pkg:npm/browserify-aes@1.2.0",
        "pkg:npm/browserify-cipher@1.0.1",
        "pkg:npm/browserify-des@1.0.2",
        "pkg:npm/browserify-rsa@4.1.0",
        "pkg:npm/browserify-sign@4.2.1",
        "pkg:npm/browserslist@4.21.4",
        "pkg:npm/buffer-from@1.1.2",
        "pkg:npm/buffer-xor@1.0.3",
        "pkg:npm/builtin-status-codes@3.0.0",
        "pkg:npm/call-bind@1.0.2",
        "pkg:npm/camelcase@6.3.0",
        "pkg:npm/caniuse-lite@1.0.30001435",
        "pkg:npm/chalk@4.1.2",
        "pkg:npm/chokidar@3.5.2",
        "pkg:npm/chrome-trace-event@1.0.3",
        "pkg:npm/cipher-base@1.0.4",
        "pkg:npm/cliui@7.0.4",
        "pkg:npm/clone-deep@4.0.1",
        "pkg:npm/color-convert@2.0.1",
        "pkg:npm/color-name@1.1.4",
        "pkg:npm/colorette@2.0.19",
        "pkg:npm/colors@1.2.5",
        "pkg:npm/commander@2.20.3",
        "pkg:npm/commander@7.2.0",
        "pkg:npm/concat-map@0.0.1",
        "pkg:npm/create-ecdh@4.0.4",
        "pkg:npm/create-hash@1.2.0",
        "pkg:npm/create-hmac@1.1.7",
        "pkg:npm/create-require@1.1.1",
        "pkg:npm/cross-env@7.0.3",
        "pkg:npm/cross-spawn@7.0.3",
        "pkg:npm/crypto-browserify@3.12.0",
        "pkg:npm/debug@4.3.2",
        "pkg:npm/decamelize@4.0.0",
        "pkg:npm/define-properties@1.1.4",
        "pkg:npm/des.js@1.0.1",
        "pkg:npm/diff@4.0.2",
        "pkg:npm/diff@5.0.0",
        "pkg:npm/diffie-hellman@5.0.3",
        "pkg:npm/electron-to-chromium@1.4.284",
        "pkg:npm/emoji-regex@8.0.0",
        "pkg:npm/emojis-list@3.0.0",
        "pkg:npm/enhanced-resolve@5.12.0",
        "pkg:npm/envinfo@7.8.1",
        "pkg:npm/es-module-lexer@0.9.3",
        "pkg:npm/es6-object-assign@1.1.0",
        "pkg:npm/escalade@3.1.1",
        "pkg:npm/escape-string-regexp@4.0.0",
        "pkg:npm/eslint-scope@5.1.1",
        "pkg:npm/esrecurse@4.3.0",
        "pkg:npm/estraverse@4.3.0",
        "pkg:npm/estraverse@5.3.0",
        "pkg:npm/events@3.3.0",
        "pkg:npm/evp_bytestokey@1.0.3",
        "pkg:npm/execa@5.1.1",
        "pkg:npm/fast-deep-equal@3.1.3",
        "pkg:npm/fast-json-stable-stringify@2.1.0",
        "pkg:npm/fastest-levenshtein@1.0.16",
        "pkg:npm/fill-range@7.0.1",
        "pkg:npm/find-up@4.1.0",
        "pkg:npm/find-up@5.0.0",
        "pkg:npm/flat@5.0.2",
        "pkg:npm/for-each@0.3.3",
        "pkg:npm/fs-extra@7.0.1",
        "pkg:npm/fs.realpath@1.0.0",
        "pkg:npm/fsevents@2.3.2",
        "pkg:npm/function-bind@1.1.1",
        "pkg:npm/get-caller-file@2.0.5",
        "pkg:npm/get-intrinsic@1.1.3",
        "pkg:npm/get-stream@6.0.1",
        "pkg:npm/glob@7.1.7",
        "pkg:npm/glob-parent@5.1.2",
        "pkg:npm/glob-to-regexp@0.4.1",
        "pkg:npm/gopd@1.0.1",
        "pkg:npm/graceful-fs@4.2.10",
        "pkg:npm/growl@1.10.5",
        "pkg:npm/has@1.0.3",
        "pkg:npm/has-flag@4.0.0",
        "pkg:npm/has-property-descriptors@1.0.0",
        "pkg:npm/has-symbols@1.0.3",
        "pkg:npm/has-tostringtag@1.0.0",
        "pkg:npm/hash-base@3.1.0",
        "pkg:npm/he@1.2.0",
        "pkg:npm/https-browserify@1.0.0",
        "pkg:npm/human-signals@2.1.0",
        "pkg:npm/import-lazy@4.0.0",
        "pkg:npm/import-local@3.1.0",
        "pkg:npm/inflight@1.0.6",
        "pkg:npm/interpret@1.4.0",
        "pkg:npm/interpret@2.2.0",
        "pkg:npm/is-arguments@1.1.1",
        "pkg:npm/is-binary-path@2.1.0",
        "pkg:npm/is-callable@1.2.7",
        "pkg:npm/is-core-module@2.11.0",
        "pkg:npm/is-extglob@2.1.1",
        "pkg:npm/is-fullwidth-code-point@3.0.0",
        "pkg:npm/is-generator-function@1.0.10",
        "pkg:npm/is-glob@4.0.3",
        "pkg:npm/is-nan@1.3.2",
        "pkg:npm/is-number@7.0.0",
        "pkg:npm/is-plain-obj@2.1.0",
        "pkg:npm/is-plain-object@2.0.4",
        "pkg:npm/is-stream@2.0.1",
        "pkg:npm/is-typed-array@1.1.10",
        "pkg:npm/is-unicode-supported@0.1.0",
        "pkg:npm/isexe@2.0.0",
        "pkg:npm/isobject@3.0.1",
        "pkg:npm/jest-worker@27.5.1",
        "pkg:npm/jju@1.4.0",
        "pkg:npm/js-yaml@4.1.0",
        "pkg:npm/json-parse-better-errors@1.0.2",
        "pkg:npm/json-schema-traverse@0.4.1",
        "pkg:npm/json5@2.2.1",
        "pkg:npm/jsonfile@4.0.0",
        "pkg:npm/kind-of@6.0.3",
        "pkg:npm/level-js@6.1.0",
        "pkg:npm/loader-runner@4.3.0",
        "pkg:npm/loader-utils@2.0.4",
        "pkg:npm/locate-path@5.0.0",
        "pkg:npm/locate-path@6.0.0",
        "pkg:npm/lodash.get@4.4.2",
        "pkg:npm/lodash.isequal@4.5.0",
        "pkg:npm/log-symbols@4.1.0",
        "pkg:npm/lru-cache@6.0.0",
        "pkg:npm/ltgt@2.2.1",
        "pkg:npm/make-error@1.3.6",
        "pkg:npm/mcl-wasm@0.9.0",
        "pkg:npm/md5.js@1.3.5",
        "pkg:npm/merge-stream@2.0.0",
        "pkg:npm/micromatch@4.0.5",
        "pkg:npm/miller-rabin@4.0.1",
        "pkg:npm/mime-db@1.52.0",
        "pkg:npm/mime-types@2.1.35",
        "pkg:npm/mimic-fn@2.1.0",
        "pkg:npm/minimatch@3.0.4",
        "pkg:npm/minimist@1.2.7",
        "pkg:npm/mocha@9.1.3",
        "pkg:npm/ms@2.1.2",
        "pkg:npm/ms@2.1.3",
        "pkg:npm/nanoid@3.1.25",
        "pkg:npm/neo-async@2.6.2",
        "pkg:npm/node-loader@1.0.2",
        "pkg:npm/node-releases@2.0.6",
        "pkg:npm/normalize-path@3.0.0",
        "pkg:npm/npm-run-path@4.0.1",
        "pkg:npm/object-is@1.1.5",
        "pkg:npm/object-keys@1.1.1",
        "pkg:npm/once@1.4.0",
        "pkg:npm/onetime@5.1.2",
        "pkg:npm/os-browserify@0.3.0",
        "pkg:npm/p-limit@2.3.0",
        "pkg:npm/p-limit@3.1.0",
        "pkg:npm/p-locate@4.1.0",
        "pkg:npm/p-locate@5.0.0",
        "pkg:npm/p-try@2.2.0",
        "pkg:npm/parse-asn1@5.1.6",
        "pkg:npm/path-browserify@1.0.1",
        "pkg:npm/path-exists@4.0.0",
        "pkg:npm/path-is-absolute@1.0.1",
        "pkg:npm/path-key@3.1.1",
        "pkg:npm/path-parse@1.0.7",
        "pkg:npm/pbkdf2@3.1.2",
        "pkg:npm/picocolors@1.0.0",
        "pkg:npm/picomatch@2.3.1",
        "pkg:npm/pkg-dir@4.2.0",
        "pkg:npm/process@0.11.10",
        "pkg:npm/public-encrypt@4.0.3",
        "pkg:npm/punycode@2.1.1",
        "pkg:npm/randombytes@2.1.0",
        "pkg:npm/randomfill@1.0.4",
        "pkg:npm/readdirp@3.6.0",
        "pkg:npm/rechoir@0.6.2",
        "pkg:npm/rechoir@0.7.1",
        "pkg:npm/require-directory@2.1.1",
        "pkg:npm/resolve@1.17.0",
        "pkg:npm/resolve@1.19.0",
        "pkg:npm/resolve-cwd@3.0.0",
        "pkg:npm/resolve-from@5.0.0",
        "pkg:npm/ripemd160@2.0.2",
        "pkg:npm/run-parallel-limit@1.1.0",
        "pkg:npm/safer-buffer@2.1.2",
        "pkg:npm/schema-utils@3.1.1",
        "pkg:npm/scrypt-js@3.0.1",
        "pkg:npm/semver@7.3.8",
        "pkg:npm/serialize-javascript@6.0.0",
        "pkg:npm/setimmediate@1.0.5",
        "pkg:npm/sha.js@2.4.11",
        "pkg:npm/shallow-clone@3.0.1",
        "pkg:npm/shebang-command@2.0.0",
        "pkg:npm/shebang-loader@0.0.1",
        "pkg:npm/shebang-regex@3.0.0",
        "pkg:npm/shelljs@0.8.5",
        "pkg:npm/shx@0.3.3",
        "pkg:npm/signal-exit@3.0.7",
        "pkg:npm/source-map@0.6.1",
        "pkg:npm/source-map-support@0.5.21",
        "pkg:npm/sprintf-js@1.0.3",
        "pkg:npm/stream-browserify@3.0.0",
        "pkg:npm/stream-http@3.2.0",
        "pkg:npm/string-argv@0.3.1",
        "pkg:npm/string-width@4.2.3",
        "pkg:npm/strip-ansi@6.0.1",
        "pkg:npm/strip-final-newline@2.0.0",
        "pkg:npm/strip-json-comments@3.1.1",
        "pkg:npm/supports-color@7.2.0",
        "pkg:npm/supports-color@8.1.1",
        "pkg:npm/tapable@2.2.1",
        "pkg:npm/terser@5.16.1",
        "pkg:npm/terser-webpack-plugin@5.2.5",
        "pkg:npm/timsort@0.3.0",
        "pkg:npm/to-regex-range@5.0.1",
        "pkg:npm/ts-loader@9.3.1",
        "pkg:npm/ts-node@10.9.1",
        "pkg:npm/typescript@4.5.5",
        "pkg:npm/typescript@5.1.6",
        "pkg:npm/universalify@0.1.2",
        "pkg:npm/update-browserslist-db@1.0.10",
        "pkg:npm/uri-js@4.4.1",
        "pkg:npm/util@0.12.4",
        "pkg:npm/v8-compile-cache-lib@3.0.1",
        "pkg:npm/validator@13.7.0",
        "pkg:npm/watchpack@2.4.0",
        "pkg:npm/webpack@5.65.0",
        "pkg:npm/webpack-cli@4.9.1",
        "pkg:npm/webpack-merge@5.8.0",
        "pkg:npm/webpack-sources@3.2.3",
        "pkg:npm/which@2.0.2",
        "pkg:npm/which-typed-array@1.1.9",
        "pkg:npm/wildcard@2.0.0",
        "pkg:npm/workerpool@6.1.5",
        "pkg:npm/wrap-ansi@7.0.0",
        "pkg:npm/wrappy@1.0.2",
        "pkg:npm/xtend@4.0.2",
        "pkg:npm/y18n@5.0.8",
        "pkg:npm/yallist@4.0.0",
        "pkg:npm/yargs@16.2.0",
        "pkg:npm/yargs-parser@20.2.4",
        "pkg:npm/yargs-unparser@2.0.0",
        "pkg:npm/yn@3.1.1",
        "pkg:npm/yocto-queue@0.1.0",
        "pkg:npm/z-schema@5.0.4",
        "pkg:npm/ethers@6.17.0",
        "pkg:npm/@adraffy/ens-normalize@1.11.1",
        "pkg:npm/@noble/curves@1.2.0",
        "pkg:npm/@noble/hashes@1.3.2",
        "pkg:npm/@types/node@22.7.5",
        "pkg:npm/undici-types@6.19.8",
        "pkg:npm/aes-js@4.0.0",
        "pkg:npm/tslib@2.7.0",
        "pkg:npm/ws@8.21.0",
        "pkg:npm/fast-check@4.10.2",
        "pkg:npm/pure-rand@8.4.2",
        "pkg:npm/ganache@7.9.2",
        "pkg:npm/@trufflesuite/bigint-buffer@1.1.10",
        "pkg:npm/node-gyp-build@4.4.0",
        "pkg:npm/@trufflesuite/uws-js-unofficial@20.30.0",
        "pkg:npm/bufferutil@4.0.7",
        "pkg:npm/utf-8-validate@6.0.3",
        "pkg:npm/@types/seedrandom@3.0.1",
        "pkg:npm/abstract-level@1.0.3",
        "pkg:npm/buffer@6.0.3",
        "pkg:npm/base64-js@1.5.1",
        "pkg:npm/ieee754@1.2.1",
        "pkg:npm/catering@2.1.1",
        "pkg:npm/is-buffer@2.0.5",
        "pkg:npm/level-supports@4.0.1",
        "pkg:npm/level-transcoder@1.0.1",
        "pkg:npm/module-error@1.0.2",
        "pkg:npm/queue-microtask@1.2.3",
        "pkg:npm/level-concat-iterator@3.1.0",
        "pkg:npm/async-eventemitter@0.2.4",
        "pkg:npm/async@2.6.4",
        "pkg:npm/lodash@4.17.21",
        "pkg:npm/emittery@0.10.0",
        "pkg:npm/keccak@3.0.2",
        "pkg:npm/node-addon-api@2.0.2",
        "pkg:npm/readable-stream@3.6.0",
        "pkg:npm/inherits@2.0.4",
        "pkg:npm/string_decoder@1.3.0",
        "pkg:npm/safe-buffer@5.2.1",
        "pkg:npm/util-deprecate@1.0.2",
        "pkg:npm/leveldown@6.1.0",
        "pkg:npm/napi-macros@2.0.0",
        "pkg:npm/secp256k1@4.0.3",
        "pkg:npm/elliptic@6.5.4",
        "pkg:npm/brorand@1.1.0",
        "pkg:npm/hash.js@1.1.7",
        "pkg:npm/minimalistic-assert@1.0.1",
        "pkg:npm/hmac-drbg@1.0.1",
        "pkg:npm/minimalistic-crypto-utils@1.0.1",
        "pkg:npm/solc@0.8.37",
        "pkg:npm/command-exists@1.2.9",
        "pkg:npm/follow-redirects@1.16.0",
        "pkg:npm/js-sha3@0.8.0",
        "pkg:npm/memorystream@0.3.1",
        "pkg:npm/tmp@0.2.6"
      ]
    }
  ]
}