Generate an SBOM from the resolved dependency data your build already has: the lockfile for npm, the environment or requirements for Python, and the Maven build for Java. Each ecosystem has a standard tool that writes CycloneDX or SPDX. Then check that versions and transitive dependencies are present.
Quick decision table
| Ecosystem | Tool | Reads from | Formats |
|---|---|---|---|
| npm | Built in command, npm sbom | Dependency tree and lockfile | CycloneDX or SPDX |
| Python | CycloneDX Python (cyclonedx-py) | Environment, requirements, Poetry, Pipenv | CycloneDX |
| Maven | CycloneDX Maven plugin | The build, all modules | CycloneDX, XML and JSON |
npm
The npm CLI documents a command that generates an SBOM listing the dependencies of the current project, in SPDX or CycloneDX. If you limit it to the lockfile, it reads only the lock data, so fields from each dependency's own package.json, such as description or homepage, are missing.
npm sbom --sbom-format cyclonedx > sbom.cdx.json
Python
CycloneDX Python builds an SBOM from a virtual environment, from pip requirements, or from Poetry and Pipenv projects. Building from an environment captures what is actually installed, which is usually more complete than a loose requirements file.
Install the tool with pip, pipx, Poetry or uv as its documentation describes, then run it against the active environment.
cyclonedx-py environment > sbom.cdx.json
Maven
The CycloneDX Maven plugin's aggregate goal creates one BOM at the build root using dependencies from the whole multi-module build. By default it writes both XML and JSON into the target directory.
mvn org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom
Check the output
- Components have exact versions, not ranges.
- Transitive dependencies are listed, not just those in your manifest.
- Each component has an identifier a machine can match, such as a package URL.
- The SBOM describes the right product and build, and has a timestamp.
- It validates against the format's schema.
Regenerate on every build. An SBOM from last quarter describes last quarter's software.
Try it yourself
Open the demo and see how an inventory of direct and transitive dependencies is built from a manifest.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard's SBOM and dependency scanning generates and keeps SBOMs and checks them for known vulnerabilities. A free scan is a quick way to see the result for your own project.
Quick check
Which format should I choose?
Use whichever your customers or regulators ask for. Both CycloneDX and SPDX are widely supported, and most tools convert between them with some loss.
Do dev dependencies belong in the SBOM?
It depends on what you ship. Mark scope clearly so readers can tell runtime components from build tools.
Sources
- npm Docs, npm sbom (formats and lockfile only behaviour).
- CycloneDX Python repository on GitHub (inputs and commands).
- CycloneDX Maven plugin repository on GitHub (makeAggregateBom goal, default outputs).
Last reviewed: 19 October 2026.
