{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a0d5caaa-4910-55ee-a8c7-63422988b1a5",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "npm",
      "purl": "pkg:npm/npm@5.10.0-tuxcare.1",
      "type": "library",
      "bom-ref": "pkg:npm/npm@5.10.0-tuxcare.1",
      "version": "5.10.0-tuxcare.1",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-16775",
      "affects": [
        {
          "ref": "pkg:npm/npm@5.10.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c1563087-4688-5eb9-8c20-d9184c7312bc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-16775 does not affect version 5.10.0-tuxcare.1 of npm. already_fixed \u2014 CVE-2019-16775 has been fixed in npm 5.10.0-tuxcare.1 via TuxCare backport commit d24215955 which upgraded bin-links from 1.1.0 to 1.1.8. The fixed bin-links version includes npm-normalize-package-bin for path sanitization and validation checks to prevent symlinks outside package directories.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-16776",
      "affects": [
        {
          "ref": "pkg:npm/npm@5.10.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:97c237b5-2a2c-5df8-9867-84f3f3e7e42c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-16776 does not affect version 5.10.0-tuxcare.1 of npm. already_fixed \u2014 CVE-2019-16776 has been fixed by TuxCare in commit 38416fab7. The fix updates package.json to require bin-links ^1.1.8, which includes the security patches (npm-normalize-package-bin for path sanitization and indexOf validation for path containment). While the bin-links module code is not physically present in the git repository (as dependencies are not committed in Node.js projects), the packa...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-16777",
      "affects": [
        {
          "ref": "pkg:npm/npm@5.10.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cfe20a97-9f75-5f40-9a85-6c51e10b111e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-16777 does not affect version 5.10.0-tuxcare.1 of npm. already_fixed \u2014 CVE-2019-16777 has been fixed in this repository. TuxCare applied the upstream fix in commit d24215955 (JSELS-3218) by upgrading bin-links to 1.1.8 and gentle-fs to 2.3.1, matching the upstream fix versions (1.1.6 and 2.3.0 respectively). The fix prevents arbitrary file overwrite of global binaries by adding clobberLinkGently logic that refuses to overwrite existing global bin/man links unless ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-15095",
      "affects": [
        {
          "ref": "pkg:npm/npm@5.10.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1f75dc71-5d56-54ff-b914-ce2d78f9bc67",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-15095 does not affect version 5.10.0-tuxcare.1 of npm. already_fixed \u2014 CVE-2020-15095 has been fixed in this repository. TuxCare backported the upstream npm 6.14.6 fix to npm 5.10.0 via commit 39a38e19d (JSELS-3223). The fix introduces lib/utils/replace-info.js which sanitizes URLs by replacing password fields with '***' before logging. This defense is correctly applied in bin/npm-cli.js, lib/utils/error-handler.js, lib/utils/error-message.js, and lib/fetch-packag...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-0775",
      "affects": [
        {
          "ref": "pkg:npm/npm@5.10.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9167ec51-bac5-5e26-8f33-2a232c55386e",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2026-0775 is a false positive for npm 5.10.0-tuxcare.1."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/npm@5.10.0-tuxcare.1"
    }
  ]
}