Standardizing SBOM inclusion in npm package tarballs

Packages distributed through npm registries currently have no standard mechanism for communicating what's inside them beyond package.json dependencies and source code inspection. This is particularly problematic for packages that ship compiled binaries or native addons. Consumers have no practical way to know what native libraries are statically linked into a .node binary or prebuilt executable.

An SBOM (Software Bill of Materials) included in the package tarball could address this gap. A well-known file location (e.g. sbom.cdx.json or sbom.spdx.json at the package root) would allow tooling, registries, and consumers to discover and use this information in a consistent way.

I couldn't find any existing work or prior discussion on this topic.

I'm raising this here because this feels like a packaging convention question. Please, let me know if another forum is better for this.

I'd be happy to help drive this effort forward with the community if there's an interest.

Start with the package.json dependency model and the proposed sbom.cdx.json or sbom.spdx.json files at the package root, considering packages with .node binaries or prebuilt executables. Done would require community agreement on a standard location and format convention that tooling, registries, and consumers can discover consistently.