cbom-tools: CBOM scanner + diff for Node.js projects

[Lennonhaha]

Hi all,

I've built an open-source CLI that scans Node.js projects and emits CycloneDX 1.6 CBOM, plus a diff tool for CI gating.

What it does:

• cbom-scan --dir ./project --out cbom.json — generates CycloneDX 1.6 CBOM
• cbom-diff before.json after.json — exit 0/1/2 for CI

Inputs:

• package.json dependencies (rule table: @noble/post-quantum, sm-crypto, etc.)
• Source files (.js/.cjs/.mjs/.ts) via crypto.createHash() patterns

Why I built it:
Migrating to post-quantum crypto requires knowing what algorithms a project uses. Manual CBOM maintenance was painful at ~4000 lines — this tool makes it one command.

Details:

• npm: npm install -g cbom-tools
• Repo: https://github.com/LennonHaha/fibemate-tools (cbom-tools/ subdirectory)
• License: Apache-2.0, zero dependencies
• 17 CLI contract tests

Not yet: Python / Go support — happy to add if there's interest.

Related discussion I saw in #cryptography-bom: Jan Kowalleck asked about JS CBOM generation earlier. This may be relevant.

Happy to hear feedback — especially on the algorithm coverage and whether to integrate with the Cryptography Registry.

[jkowalleck]

please consider adding your tool to the CycloneDX tool center - https://cyclonedx.org/tool-center.

Here is a description how to add a tool: https://github.com/CycloneDX/tool-center#contributing