Improve hash support about cyclonedx-node-module HOT 3 CLOSED

Hi there!

I am also having a problem with hash support that I think is related to this issue.

When I use the cyclonedx-bom CLI tool against a simple Node.js app that contains node modules, the resulting BOM file does not contain any hash content for the node modules if the Node Engine version is v15.X.X or v16.X.X. I'm not sure if the mechanism for surfacing this information has changed in these versions, but collecting the hash metadata definitely does not work for those versions

Edit: It appears that in Node Engine v15, the NPM version inside changed which includes a new package-lock.json format. The package.json files of each node module also appear to not contain the hashes, but the top level package.json does.

from cyclonedx-node-module.

Additionally, it looks like the hashes included come from the _shasum field inside of each node module's package.json. What is the rationale for using this field rather than the integrity field from the top level package-lock.json?

from cyclonedx-node-module.

this feature was implemented in the NPM flavour of this package:
https://github.com/CycloneDX/cyclonedx-node-npm/

from cyclonedx-node-module.