In CycloneDX 1.6, use supplier for the organization that supplied the component to you, publisher for whoever published it, and authors or manufacturer instead of the deprecated author string. If you must pick one field to satisfy a buyer's request for the supplier name, supplier is the right one.
What the schema says
The 1.6 JSON reference describes these fields on a component.
| Field | Definition in the spec |
|---|---|
| supplier | The organization that supplied the component. It may often be the manufacturer, but may also be a distributor or repackager |
| publisher | The person or organization that published the component |
| author | Deprecated. Use authors or manufacturer instead |
| authors | The people who created the component, typically in manual creation |
| manufacturer | An organization object, common in automated builds |
The supplier object can carry a name, address, urls and contacts, and a bom-ref.
Choosing in practice
A component taken from a public package registry has a project that wrote it, a registry that hosts it and possibly a distributor that repackaged it. The spec's wording makes supplier the party that supplied what you actually have, which in a rebuild is the distributor, not the original author.
"supplier": { "name": "Example Distribution", "url": ["https://example.org"] },
"publisher": "Example Project Team"
If you only know a project name, put it in publisher and supplier together only if you are confident they are the same. Otherwise leave supplier empty rather than copying a registry name, because the NTIA minimum elements define supplier as the entity that creates, defines and identifies components. A hosting site does not do that.
Common mistakes
Filling author with a person's name. It is deprecated, and personal data in a shared SBOM may be unwelcome. Use authors if you must, and check your sharing policy first.
Using the same string everywhere. If every component says the same organization, a reader will assume a default.
Mixing registry names into supplier. Treat "npm" or a similar registry as a source of metadata, not as a supplier.
Leaving supplier blank across the file. NTIA lists supplier name as a minimum data field, so blanks will show up on any minimum elements check.
A fill strategy that scales
- Take supplier from package metadata where the registry exposes an organization.
- For internal components, set supplier to your own organization.
- For gaps, try the project's own site or repository owner, and record how you decided in a property or comment.
- Report the fill rate each release, and set a target that rises over time.
Handling the rest
Where you cannot determine a supplier, do not invent one. A blank is honest. A wrong value is worse, since customers use it to decide whom to ask about a defect.
Safeguard can generate SBOMs and run dependency scanning across your repositories, so the fields discussed here are checked on real projects instead of by hand. You can try the free scan at gold.safeguard.sh/scan.
Quick check
Is publisher the same as supplier?
No. Publisher is who published the component. Supplier is the organization that supplied it, which may be a distributor or repackager.
Should I still use the author field?
The 1.6 reference marks it deprecated and points to authors or manufacturer.
Sources
Last reviewed: 19 October 2026.
