An unfamiliar name in a received SBOM is usually a transitive dependency pulled in by something you do recognize. Identify it in five steps: read its PURL, look it up in the registry, check its references, find the component that depends on it, and compare any hash. Only then decide whether to ask the supplier.
Why strangers are normal
Applications are built from layers. A web framework might pull in a dozen helper libraries, and those pull in more. The NTIA minimum elements report describes the dependency relationship field as the way to represent transitivity from a piece of software to its components and their subcomponents. Most names you will not know are several levels down.
Not recognizing a name is not a finding. It is a prompt to look.
Step 1: Read the identifier
Find the component's PURL. The Package-URL specification defines it as scheme, type, namespace, name, version, qualifiers, and subpath. The type tells you the ecosystem. The namespace often tells you the owner, for example a Maven group ID or an npm scope.
pkg:maven/org.apache.xmlgraphics/batik-anim@1.9.1
This one is a Maven artifact from the group org.apache.xmlgraphics. Even without knowing the library, you now know where to look.
Step 2: Look it up at the source
Take the type and name to the matching public registry and read the project page. You are checking four things: does the package exist, is the name the same, who maintains it, and is the version you were given a real release. A package that does not exist at that version is a data quality problem in the SBOM, and worth a question.
Step 3: Use the references in the file
CycloneDX components can carry external references. The 1.6 reference lists types such as vcs, website, advisories, distribution, and security-contact. If the supplier included a repository link, follow it. If the SBOM includes none, that is useful information about how complete the data is.
Step 4: Find the parent
Walk the dependency graph backward. Which component lists the stranger in its dependsOn? In SPDX, which package has a DEPENDS_ON relationship to it? Once you know the parent, the question changes from "what is this?" to "do I accept that this parent needs it?" That is usually easier.
A jq filter for CycloneDX, with the real ref in place of the example:
jq '.dependencies[] | select(.dependsOn | index("pkg:maven/org.apache.xmlgraphics/batik-anim@1.9.1"))' bom.json
Step 5: Compare the hash
If the component has a hash in the SBOM, and you can obtain the same artifact from the registry, compute your own and compare. A match means you are looking at the same bytes the supplier described. CycloneDX supports several algorithms, including SHA-256 and SHA-512. A mismatch is not proof of tampering, since builds and rebuilds differ, but it is worth a question.
When to escalate
| Situation | Action |
|---|---|
| Package exists, known maintainer, plausible parent | Note and move on |
| Package exists but looks abandoned | Add to your dependency risk list |
| Name resembles a popular package but differs slightly | Ask the supplier right away |
| No such package at that version | Ask for a corrected SBOM |
| No parent in the graph | The graph is thin; ask for fuller data |
The near match case deserves care. Lookalike names are a known tactic in package ecosystems, so confirm the exact spelling against the registry before assuming it is harmless.
Try it yourself
Click through it at your own pace, or open it full screen.
Pick a component you do not know and see how direct and transitive dependencies are shown.
Where Safeguard fits
Safeguard provides SBOM and dependency scanning with reachability analysis. A free scan at gold.safeguard.sh/scan shows how your own code pulls in its dependencies.
Quick check
Should I ask the vendor about every unfamiliar component?
No. Check it yourself first using the identifier and registry. Ask only when something does not add up.
Can the SBOM include components the vendor does not use?
Yes. Source level SBOMs can list libraries that never reach the shipped product. Ask which lifecycle stage the file reflects.
Sources
- Package-URL specification README
- CycloneDX 1.6 JSON reference
- The Minimum Elements for an SBOM, NTIA
Last reviewed: 19 October 2026.
