cdx: Custom Properties

This page documents the current cdx: custom properties emitted by cdxgen, the ecosystems they map to, and practical supply-chain security/assurance use cases.

Scope

• Source of truth: non-test source files under lib/** (including lib/helpers/utils.js and lib/helpers/ciParsers/*).
• These are cdxgen-specific properties added to CycloneDX objects (components, workflows, tasks, metadata, and services).
• They are intended to enrich analysis and policy decisions; they are not CycloneDX core fields.

Legacy compatibility properties

• This page inventories the current namespaced cdx:* custom properties. It does not treat older unnamespaced compatibility properties as part of the preferred property surface.
• Current legacy examples still seen in some outputs include SrcFile, ImportedModules, and LocalNodeModulesPath.
• Prefer standard CycloneDX modeling first: use evidence.occurrences[].location and evidence.identity[].methods[].value for discovery/source evidence, and use BOM metadata properties such as cdx:bom:componentSrcFiles for aggregated manifest-origin signals.
• Treat LocalNodeModulesPath as environment-specific and potentially sensitive; downstream policies should avoid depending on it.
• Expect these legacy keys to remain compatibility-oriented and less stable than the namespaced cdx:* inventory below.

How to read these properties

Some CI/CD properties are derived from a workflow or job context but may also be duplicated onto related components/tasks to support policy engines that primarily scan input.components. In those cases, treat the Scope column as indicating the primary origin plus common duplicated locations used for policy consumption.

Value semantics and normalization

CycloneDX custom properties are emitted as name/value pairs, so consumers should assume that all values are serialized as strings even when they represent booleans, numbers, timestamps, or structured data.

Shape	Typical encoding	Examples	Policy note
Boolean	"true", "false"	cdx:github:workflow:hasWritePermissions, cdx:npm:hasInstallScript, cdx:maven:shaded	Compare as strings in OPA/CEL unless your ingestion layer normalizes values first
Number-like	decimal string	cdx:github:job:timeoutMinutes, cdx:pixi:build_number	Treat as strings unless your policy engine performs numeric coercion
Lists	comma-separated or newline-separated strings	cdx:github:workflow:triggers, cdx:npm:risky_scripts, cdx:bom:componentSrcFiles	Component-level lists are typically comma-separated; BOM-level metadata lists are typically newline-separated. Split explicitly before matching multi-value logic
Paths / URLs	plain string	cdx:github:workflow:file, cdx:swift:localCheckoutPath, cdx:pypi:registry	Useful as provenance and source-of-truth signals
Timestamps	ISO 8601 string	cdx:go:creation_time, cdx:nix:last_modified	Suitable for recency or reproducibility gates
Structured payloads	JSON-serialized string	cdx:pip:structuredMarkers, cdx:cargo:features	Parse the JSON string before field-level inspection; do not compare nested fields as raw text unless your policy engine lacks JSON parsing

Policy readiness shorthand

• Hard deny: good primary candidate for blocking policies.
• Warning / triage: useful for prioritization, human review, or score weighting.
• Context only: useful for evidence, provenance, explainability, or enrichment, but usually weak as a standalone gate.

Property families, ecosystems, and assurance use cases

Family	Ecosystem / context	What it captures	Security & assurance use cases	Inventory	Example rules
cdx:github:*, cdx:actions:*	GitHub Actions workflows	Workflow/job/step metadata, action references, version pinning style, permission posture, triggers, runner context	Detect unpinned actions, flag workflows/jobs with write privileges, validate OIDC (id-token) usage boundaries, review exposure by trigger type and environment	CI/CD and workflow provenance	1, 6
cdx:gitlab:*	GitLab CI	Pipeline/job stage/image/environment/services/needs metadata	Review pipeline trust boundaries, identify risky service/image usage, validate stage/order dependency intent	CI/CD and workflow provenance	1
cdx:azure:*	Azure Pipelines	Pipeline file, pool image, trigger branches, stage/job dependencies and conditions	Detect privileged runner pools, verify deployment gating/conditions, ensure branch-scoped execution policy	CI/CD and workflow provenance	1
cdx:circleci:*	CircleCI	Config/workflow/job relationships, branch filters, orb/executor references	Verify job execution constraints (branch-only), inspect third-party orb use, map build graph for provenance review	CI/CD and workflow provenance	1
cdx:jenkins:*	Jenkins declarative pipelines	Jenkinsfile source, agent selection, stage metadata (when, parallel)	Audit build agent trust model, identify conditional/parallel execution complexity and potential bypass paths	CI/CD and workflow provenance	1
cdx:npm:*, cdx:pnpm:alias	Node.js (npm/pnpm)	Binary/script execution surfaces, native addon signals, lock/runtime mismatches, local/path/workspace/alias details	Prioritize packages with install-time execution risk, detect name/version spoofing indicators, identify non-registry or file-based dependencies	Package manager and language ecosystems	2
cdx:pypi:*, cdx:pip:*, cdx:pyproject:*, cdx:python:*, cdx:pixi:*, cdx:pylock:*	Python (pip/requirements, pyproject, lock formats, pixi, PEP 751 pylock)	Version constraints, extras, environment markers, registry origin, interpreter constraints, pixi/pylock lock metadata	Enforce allowed index/registry policy, evaluate conditional dependency exposure by marker, retain pylock metadata not directly representable in CycloneDX	Package manager and language ecosystems	3
cdx:gem:*	RubyGems/Bundler	Gem platform/source/revision/tag/branch, ruby constraints, executable presence, prerelease/yanked status	Detect mutable VCS-sourced gems, platform-specific attack surface, and yanked/prerelease risk in resolved dependency sets	Package manager and language ecosystems	3
cdx:cargo:*	Rust crates.io	Crate metadata linkage (id/latest/rust version/features)	Validate Rust toolchain compatibility, flag feature-driven attack surface changes, monitor lag from newest upstream version	Package manager and language ecosystems	4
cdx:go:*	Go modules	Toolchain, indirect/deprecated/local replacement timing metadata	Detect local replacements/non-hermetic resolution, track deprecated modules, validate direct vs indirect risk posture	Package manager and language ecosystems	4
cdx:golem:*	Go Evinse evidence	Semantic Go usage scopes, occurrence kinds, call graph mode, build directives, native artifacts, security signals, vendoring, and module replacement context	Prioritize reachable Go dependency review, flag local replacements and private modules, audit generated/native build surfaces, and separate runtime from test-only usage	Golem Go Evinse evidence	4
cdx:rusi:*	Rust Evinse evidence	Semantic Rust usage scopes, occurrence kinds, call graph mode, data-flow slices, crypto assets, and security signals	Prioritize reachable Rust dependency review, audit crypto reachability and data-flow provenance, flag security-sensitive API usage, and separate runtime from test-only usage	Rusi Rust Evinse evidence	5
cdx:dotnet:*	.NET / NuGet / assemblies	Target framework, project guid, assembly identity/version, hint path, Azure Functions version	Verify framework support policy, detect assembly/package identity mismatches, analyze implicit GAC/hint-path sourced dependencies	Package manager and language ecosystems	5
cdx:maven:*, cdx:gradle:*	Java (Maven/Gradle)	Effective component scope, shaded namespace evidence, Gradle root path context	Identify shadowed/relocated classes (obfuscation or vendoring risk), enforce dependency-scope policy, track monorepo/root provenance	Package manager and language ecosystems	5
cdx:nix:*	Nix flakes	Input source URLs, lock revision/ref/hash/time, flake directory	Validate immutable lock intent, detect unexpected source URL changes, support reproducibility/provenance checks	Package manager and language ecosystems	4
cdx:swift:*	Swift Package Manager	Logical package naming and local checkout paths	Identify local checkout dependencies vs remote source dependencies; enforce source-origin controls	Package manager and language ecosystems	3
cdx:pods:*	CocoaPods	Podspec location, project directory, pod/subspec mapping	Distinguish local/path/git pod sourcing, trace subspec-enabled feature surface, improve provenance for iOS supply chains	Package manager and language ecosystems	3
cdx:pub:*	Dart pub	Non-default registry URL	Enforce approved package registry policy and detect mirror/private feed usage	Package manager and language ecosystems	3
cdx:ai:*, cdx:gguf:*, cdx:huggingface:*	AI/ML inventory, local model artifacts, GGUF model files, and Hugging Face metadata	Model/runtime/provider hints, deployment posture, explicit model IDs, context windows, quantization/encoding signals, GGUF artifact metadata, and Hugging Face popularity/runtime signals	Flag risky local AI rollouts, separate remote inference from local artifacts, audit very large context windows, track GGUF shards/sidecars, preserve model lineage context, and review remote-model governance/runtime posture	AI / model artifact inventory	5
cdx:bom:*	BOM-level metadata	Component type set, discovered namespaces, source manifest files	Measure BOM completeness, identify broad component diversity, and support attestable “evidence-of-origin” for manifest inputs	Cross-cutting BOM/service/build metadata	5
cdx:build:versionSpecifiers	Build/manifest parsing (for example C/C++ build metadata)	Non-exact version constraints captured from build descriptors	Highlight non-pinned dependency constraints and prioritize hardening toward deterministic builds	Cross-cutting BOM/service/build metadata	5
cdx:crypto:*	Rootfs/host trust material enrichment	Trust domain, source type, fingerprint, key IDs, key strength, user IDs, and certificate lifecycle metadata	Audit repository trust anchors, CA-store content, and filesystem trust drift; distinguish package-signing keyrings from CA bundles	Cross-cutting BOM/service/build metadata	5
cdx:dosai:*	Dosai source-level crypto analysis (CBOM)	Dosai asset/operation/material metadata: internal ID, strength, reachability, entry-point count, data-flow slice IDs, and storage kind (for example hardcoded)	Identify hard-coded cryptographic material, audit crypto reachability from entry points, and review data-flow provenance for crypto operations detected by static analysis	Cross-cutting BOM/service/build metadata	5
cdx:osquery:category	Host/package discovery via osquery	Query/source category for discovered packages	Separate inventory confidence by collection method and tune host-level evidence policies	Cross-cutting BOM/service/build metadata	5
cdx:darwin:codesign:*, cdx:darwin:notarization:*, cdx:darwin:gatekeeper:*	macOS host trust enrichment	Code-sign identifier/team ID/authority/runtime info, notarization assessment/source/origin, and Gatekeeper policy status	Review signed-software provenance, identify unsigned or weakly trusted apps, and correlate execution policy with launchd/software inventory	Cross-cutting BOM/service/build metadata	5
cdx:windows:authenticode:*, cdx:windows:wdac:*	Windows host trust enrichment	Authenticode validation/signer/timestamp metadata and WDAC active-policy inventory	Confirm signer trust, identify unsigned persistence binaries, and inventory WDAC enforcement state	Cross-cutting BOM/service/build metadata	5
cdx:lolbas:*	Windows osquery / OBOM enrichment	LOLBAS-derived ATT&CK tactics/techniques, functions, contexts, and risk tags parsed from Windows host telemetry	Highlight Windows proxy-execution helpers in run keys, tasks, WMI, services, and live process data	Cross-cutting BOM/service/build metadata	5
cdx:gtfobins:*	Container executable enrichment	GTFOBins-derived functions, privileged contexts, ATT&CK techniques, and risk tags for collected executables	Flag container-escape helpers, privileged binaries, exfiltration tooling, and mutable-path attack kits in container SBOMs	Cross-cutting BOM/service/build metadata	5
cdx:container:*	Container executable enrichment	ATT&CK-for-Containers tags, Peirates/CDK/DEEPCE playbook references, and seccomp-sensitive syscall context	Detect offensive toolkit binaries, map cluster-pivot helpers to ATT&CK, and review images that become riskier under permissive seccomp profiles	Cross-cutting BOM/service/build metadata	5
cdx:vscode-extension:*	VS Code / IDE extensions (.vsix and installed dirs)	Activation events, extension kind, contributed features, lifecycle scripts, workspace trust posture	Detect always-on extensions, flag install-time script execution, audit host/filesystem access, enforce workspace trust and virtual workspace policies	IDE and editor extensions	7
cdx:chrome-extension:*	Chromium browser extensions (-t chrome-extension, -t os)	Browser/profile context, Chrome/Edge/Brave manifest metadata, capability signals from manifest + Babel source analysis	Flag broad host permissions, web-request interception capability, file/device/network/bluetooth/accessibility/code-injection/fingerprinting exposure	IDE and editor extensions	7
cdx:asar:*	Electron ASAR archives (-t asar)	Archive file counts, entry metadata, declared/computed integrity, JS capability summaries, embedded manifest inventory	Catalog packaged release contents, review eval/dynamic fetch behavior, flag integrity mismatches, and audit embedded Node packages shipped inside desktop artifacts	IDE and editor extensions	7
cdx:mcp:*	JavaScript / TypeScript MCP source plus config inventory	MCP SDK/config provenance, server transport/auth posture, registered tools/prompts/resources, explicit model/provider literals	Detect unauthenticated MCP HTTP exposure, review config-only MCP services, surface trust/credential posture, and inventory the server primitives exposed to models	Cross-cutting BOM/service/build metadata	5
cdx:agent:*	AI agent instruction / skill file discovery	Hidden Unicode, inferred MCP endpoints, provider mentions, auth hints, tunnel exposure, hidden component indicators	Surface agent-driven runtime dependencies that are not obvious from lockfiles alone and flag risky public/tunneled MCP references for compliance review	Cross-cutting BOM/service/build metadata	5
cdx:ai:codegen:*	AI-generated code and authorship provenance (-t ai-provenance, cdx-audit)	Detection status, aggregate confidence/band, detected tools (Claude Code, Copilot, Cursor, Devin, etc.), development phases (dev/test/review/ci), per-tool evidence, and a signals JSON blob	Flag AI/LLM/agent-authored code for copyright/licensing review (AI-authored code may lack copyright protection), require disclosure of AI usage, and drive ai-provenance audit rules (AIPROV-001/002)	Cross-cutting BOM/service/build metadata	5
cdx:ai:codegen:models, cdx:ai:codegen:agents (et al.)	Git-ai note attribution details (-t ai-provenance, cdx-audit)	Model names, agent tool names, session/prompt counts, and AI-attributed line+range entry counts from git-ai notes	Surface precise AI model/agent attribution evidence from git-ai line-level notes for audit and policy review	Cross-cutting BOM/service/build metadata	5
cdx:ai:oversight:*	AI human-oversight & process-rigor (-t ai-provenance, cdx-audit)	Rigor score/band, verification-debt/review-coverage/self-merge (forge-only, else unavailable), CI-weakening events, sign-off & CODEOWNERS coverage, AI line ratio, data sources, and an evidence JSON blob	Detect rubber-stamping of AI-authored code, evidence meaningful human oversight (EU AI Act Art. 12/14, NIST AI RMF, ISO/IEC 42001), and drive ai-oversight audit rules (AIOVS-001..006)	Cross-cutting BOM/service/build metadata	5
cdx:service:httpMethod	OpenAPI/service evidence	HTTP method associated with discovered service endpoints	Support API exposure reviews (method-level attack surface and access-control assurance)	Cross-cutting BOM/service/build metadata	5

Useful keys

These are the highest-leverage keys for first-pass policy authoring.

Key	Why it matters	Policy readiness
cdx:github:action:isShaPinned	Distinguishes immutable commit-pinned actions from mutable tag/branch references	Hard deny
cdx:github:workflow:hasWritePermissions	Quickly identifies workflows that can modify repository or packages	Hard deny
cdx:github:workflow:hasIdTokenWrite	Flags OIDC token issuance capability	Hard deny
cdx:npm:hasInstallScript	Captures install-time execution surface	Hard deny
cdx:npm:bin	Lists executable commands exposed by an npm package	Warning / triage
cdx:npm:has_binary	Quick boolean for npm packages that expose executable commands	Warning / triage
cdx:asar:hasIntegrityMismatch	Flags ASAR entries whose declared integrity hash does not match the computed archive content	Hard deny
cdx:npm:isRegistryDependency	Detects git/file/local sources vs standard registry resolution	Hard deny
cdx:mcp:transport	Distinguishes stdio-only MCP servers from network-exposed Streamable HTTP servers	Hard deny
cdx:mcp:officialSdk	Separates official MCP SDK usage from non-official wrappers and forks	Warning / triage
cdx:mcp:toolCount	Highlights servers exposing model-controlled tools	Hard deny
cdx:mcp:serviceType	Distinguishes MCP server, client, and gateway roles inferred from source	Warning / triage
cdx:mcp:outboundHosts	Captures remote hosts reached by MCP-adjacent source usage	Hard deny
cdx:mcp:authPosture	Normalizes bearer/OAuth/protected-resource/no-auth posture	Hard deny
cdx:mcp:trustProfile	Summarizes official-vs-networked-vs-authenticated trust stance	Warning / triage
cdx:mcp:credentialExposure	Flags inline secrets in MCP configs or discovered service metadata	Hard deny
cdx:mcp:security:confusedDeputyRisk	Highlights DCR + static-client authorization risk in MCP config	Hard deny
cdx:mcp:security:tokenPassthroughRisk	Flags config-driven bearer/access-token forwarding	Hard deny
cdx:agent:hasPublicMcpEndpoint	Flags public MCP endpoints referenced in agent instructions	Hard deny
cdx:agent:hasTunnelReference	Flags ngrok/Cloudflare-tunnel style exposure in agent instructions	Hard deny
cdx:agent:framework	Identifies community agent/tooling ecosystems such as OpenCode, Nanocoder, LangGraph, or CrewAI	Warning / triage
cdx:tool:description	Captures discovered custom tool or command intent	Warning / triage
cdx:tool:tags	Captures command/tool tags or routing hints	Warning / triage
cdx:skill:name	Identifies discovered SKILL.md definitions	Warning / triage
cdx:langgraph:graphEntryPoint	Carries the configured graph entrypoint from langgraph.json	Warning / triage
cdx:crewai:tools	Captures configured CrewAI tool lists or references	Warning / triage
cdx:agent:credentialExposure	Flags inline secret patterns in AI agent instructions	Hard deny
cdx:agent:reviewNeeded	One-bit reviewer cue for hidden Unicode, undeclared MCP refs, or risky exposure	Warning / triage
cdx:ai:codegen:detected	Boolean cue that AI/LLM/agent authorship signals were found in the project	Warning / triage
cdx:ai:codegen:confidence	Aggregate noisy-OR confidence (0.00-0.99) that AI authored or reviewed the code	Warning / triage
cdx:ai:codegen:confidence:band	Coarse low/medium/high confidence band for policy thresholds	Warning / triage
cdx:ai:codegen:tools	Detected AI tools (Claude Code, Copilot, Cursor, Devin, etc.) for attribution and licensing review	Warning / triage
cdx:ai:codegen:phases	Development phases (dev/test/review/ci) where AI usage was observed	Warning / triage
cdx:ai:codegen:tool:<tool>	Per-tool confidence, phases, channels, and evidence for auditability	Warning / triage
cdx:ai:codegen:evidence:json	Structured JSON of every AI signal (channel/tool/phase/evidence/confidence)	Warning / triage
cdx:ai:oversight:score	Aggregate 0.00-1.00 human-oversight/process-rigor score for AI-authored code	Warning / triage
cdx:ai:oversight:band	Coarse strong/moderate/weak rigor band for policy thresholds	Warning / triage
cdx:ai:oversight:verificationDebtRatio	Fraction of AI commits/PRs with no independent human review (unavailable without forge data)	Warning / triage
cdx:ai:oversight:reviewCoverage	Fraction of AI commits/PRs with a verified independent approval (unavailable without forge data)	Warning / triage
cdx:ai:oversight:reviewLatencyVsSize	Median review time ÷ diff size; rubber-stamp indicator (unavailable without forge data)	Warning / triage
cdx:ai:oversight:selfMergeRate	Fraction of AI PRs merged/approved by their own author (unavailable without forge data)	Warning / triage
cdx:ai:oversight:ciWeakeningEvents	Count of AI commits that delete tests or add quality-gate suppressions (--no-verify, || true)	Warning / triage
cdx:ai:oversight:signoffCoverage	Fraction of AI commits carrying a DCO Signed-off-by and/or verified signature	Warning / triage
cdx:ai:oversight:codeownersCoverage	Fraction of AI-touched paths covered by CODEOWNERS (unavailable when no CODEOWNERS file)	Warning / triage
cdx:ai:oversight:revertHotfixRate	Rate of reverts/hotfixes touching AI-authored work	Warning / triage
cdx:ai:oversight:batchSizeMedian	Median lines changed per AI commit (review-compression context)	Context only
cdx:ai:oversight:aiLineRatio	AI-authored lines ÷ total (precise from git-ai notes, else heuristic)	Context only
cdx:ai:oversight:dataSources	Channels that populated the score (git, git-ai-notes, github-api, gitlab-api)	Context only
cdx:ai:oversight:evidence:json	Structured per-signal oversight evidence (sanitized JSON) for an auditable score	Warning / triage
cdx:ai:codegen:models	Unique model names (e.g., claude-sonnet-4-20250514,gpt-4o) from git-ai notes	Warning / triage
cdx:ai:codegen:agents	Unique agent tool names (e.g., claude-code,cursor) from git-ai notes	Warning / triage
cdx:ai:codegen:noteCount	Number of git-ai notes with AI attribution entries	Context only
cdx:ai:codegen:sessionCount	Total AI sessions referenced across git-ai notes	Context only
cdx:ai:codegen:attributionCount	Total AI-attributed line+range entries across all git-ai notes	Context only
cdx:pypi:registry	Indicates non-default Python package index usage	Hard deny
cdx:gem:remoteRevision	Lets policies distinguish immutable git revisions from mutable branch/tag sourcing	Warning / triage
cdx:nix:nar_hash	Important reproducibility and content-integrity signal for flakes	Hard deny
cdx:go:local_dir	Detects local module replacements and non-hermetic resolution	Hard deny
cdx:golem:securitySignalSeverity	Highlights Go modules touched by security-sensitive semantic signals	Hard deny
cdx:golem:localReplacement	Captures local Go replacement evidence from Golem's analyzed module graph	Hard deny
cdx:golem:privateModuleCandidate	Identifies private/internal module candidates that need internal provenance controls	Warning / triage
cdx:golem:usageScopes	Separates runtime dependency use from test, benchmark, fuzz, and example-only use	Warning / triage
cdx:golem:occurrenceEvidenceKinds	Explains whether evidence came from imports, symbol calls, or symbol references	Context only
cdx:golem:callGraphMode	Shows whether Go Evinse used none, static, CHA, RTA, or VTA call graph analysis	Warning / triage
cdx:golem:dataFlowMode	Shows whether Go Evinse collected Golem data-flow slices (security, crypto, or all)	Warning / triage
cdx:golem:cryptoDataFlow	Flags a Go module with a crypto-related source-to-sink data-flow slice	Hard deny
cdx:golem:cryptoDataFlowCount	Counts crypto-related Golem data-flow slices	Warning / triage
cdx:golem:cryptoAlgorithms	Summarizes source-detected Go cryptographic algorithms	Warning / triage
cdx:rusi:securitySignalSeverity	Highlights Rust modules touched by security-sensitive semantic signals	Hard deny
cdx:rusi:cryptoFindingSeverity	Flags cryptographic findings and weaknesses in Rust dependencies	Warning / triage
cdx:rusi:dataFlowCategories	Summarizes source-to-sink data-flow categories for Rust components	Warning / triage
cdx:bom:componentSrcFiles	Useful gate for BOM completeness and downstream attestability	Warning / triage
cdx:ai:artifactFormat	Distinguishes GGUF, Modelfile, and other AI artifact/config discovery paths	Warning / triage
cdx:ai:quantization	Captures local-model weight encoding such as Q5_K_M or BF16	Warning / triage
cdx:ai:contextWindow	Exposes model context limits useful for performance and governance review	Warning / triage
cdx:huggingface:downloadsAllTime	Captures long-run Hugging Face adoption volume for a remote model or dataset	Warning / triage
cdx:huggingface:inferenceProvider	Lists provider backends advertising hosted inference support for a model	Warning / triage
cdx:huggingface:runtimeStage	Shows whether a Hugging Face Space is RUNNING, BUILDING, PAUSED, or failed	Warning / triage
cdx:gguf:sizeLabel	Preserves GGUF size-class metadata such as 7B or 8x7B	Context only
cdx:gguf:shard	Identifies sharded GGUF artifacts such as 00001-of-00002	Context only
cdx:gguf:tokenizerModel	Identifies the embedded GGUF tokenizer family such as llama or gpt2	Warning / triage
cdx:gguf:tokenizerTokenCount	Captures the embedded tokenizer vocabulary size	Context only
cdx:gguf:chatTemplateDetected	Flags GGUF artifacts that embed a chat-template contract	Warning / triage
cdx:crypto:trustDomain	Distinguishes package-signing keyrings (apt/rpm/apk) from CA-store trust material	Warning / triage
cdx:crypto:keyId	Stable repository-key identity pivot for trust-anchor review and allowlists	Warning / triage
cdx:darwin:notarization:assessment	Separates accepted vs rejected/unknown notarization assessments for macOS apps	Hard deny
cdx:darwin:codesign:teamIdentifier	Useful allowlist key for approved Apple Developer teams	Warning / triage
cdx:windows:authenticode:status	Fast unsigned/invalid-signature gate for Windows executable inventory	Hard deny
cdx:windows:wdac:activePolicyCount	Indicates whether WDAC active policy material is present on the host	Warning / triage
cdx:lolbas:names	Maps Windows startup/process telemetry to known LOLBAS binaries	Warning / triage
cdx:lolbas:attackTechniques	Carries ATT&CK techniques for matched Windows LOLBAS helpers	Warning / triage
cdx:gtfobins:functions	Encodes GTFOBins execution, file, network, and library-load primitives	Warning / triage
cdx:gtfobins:privilegedContexts	Highlights sudo/SUID/capability-backed abuse paths	Hard deny
cdx:gtfobins:riskTags	Summarizes container-escape, exfiltration, persistence, and lateral-movement risk	Warning / triage
cdx:container:offenseTools	Links executables to Peirates/CDK/DEEPCE-style intrusion playbooks	Warning / triage
cdx:container:seccompBlockedSyscalls	Shows which escape-relevant syscalls rely on relaxed seccomp	Warning / triage
cdx:vscode-extension:lifecycleScripts	Captures install-time execution surface from extension lifecycle hooks	Hard deny
cdx:vscode-extension:activationEvents	Wildcard (*) activation means always-on; broad trigger surface is higher risk	Warning / triage
cdx:vscode-extension:untrustedWorkspaces	Controls whether the extension operates in untrusted workspace contexts	Warning / triage
cdx:vscode-extension:contributes	Reveals contributed features such as terminal access, debuggers, auth providers	Warning / triage
cdx:vscode-extension:executesCode	Explicit declaration that the extension executes code; always-true is higher risk	Warning / triage
cdx:vscode-extension:vscodeEngine	Minimum VS Code version required; older engines may lack security features	Context only
cdx:chrome-extension:permissions	Captures primary Chrome extension API permission requests	Hard deny
cdx:chrome-extension:hostPermissions	Captures effective site scope from host permissions and content-script matches	Hard deny
cdx:chrome-extension:contentScriptsRunAt	Captures content script injection timing such as document_start	Warning / triage
cdx:chrome-extension:contentScriptsMatches	Captures URL match patterns declared under content_scripts[*].matches	Hard deny
cdx:chrome-extension:hasAutofill	Signals autofill-related capability detected from manifest content	Warning / triage
cdx:chrome-extension:capability:codeInjection	Signals explicit code-injection capability from manifest/source analysis	Hard deny
cdx:chrome-extension:capability:fingerprinting	Signals fingerprinting-relevant APIs/permissions from manifest/source analysis	Warning / triage

Current key inventory (grouped)

The grouped lists below remain the authoritative inventory. The compact tables, decision categories, and combinations that follow are intended to make those keys easier to operationalize.

CI/CD and workflow provenance

Authoritative grouped index

• GitHub Actions: cdx:github:action:isShaPinned, cdx:github:action:uses, cdx:github:action:versionPinningType, cdx:github:cache:hasRestoreKeys, cdx:github:cache:key, cdx:github:cache:keyUsesHashFiles, cdx:github:cache:path, cdx:github:cache:restoreKeys, cdx:github:checkout:persistCredentials, cdx:github:job:environment, cdx:github:job:hasIdTokenWrite, cdx:github:job:hasWritePermissions, cdx:github:job:if, cdx:github:job:isReusableWorkflowCall, cdx:github:job:isSelfHosted, cdx:github:job:name, cdx:github:job:needs, cdx:github:job:runner, cdx:github:job:services, cdx:github:job:timeoutMinutes, cdx:github:job:uses, cdx:github:job:writeScopes, cdx:github:reusableWorkflow:isExternal, cdx:github:reusableWorkflow:isShaPinned, cdx:github:reusableWorkflow:ref, cdx:github:reusableWorkflow:secretsInherit, cdx:github:reusableWorkflow:uses, cdx:github:reusableWorkflow:versionPinningType, cdx:github:reusableWorkflow:withKeys, cdx:github:step:command, cdx:github:step:condition, cdx:github:step:continueOnError, cdx:github:step:dispatchesWorkflow, cdx:github:step:dispatchKinds, cdx:github:step:dispatchMechanisms, cdx:github:step:dispatchReceiverConfidence, cdx:github:step:dispatchReceiverMatchBasis, cdx:github:step:dispatchReceiverWorkflowFiles, cdx:github:step:dispatchReceiverWorkflowNames, cdx:github:step:dispatchTargets, cdx:github:step:dispatchUsesExplicitRepositoryTarget, cdx:github:step:forkContextRefs, cdx:github:step:hasLocalDispatchReceiver, cdx:github:step:hasOutboundNetworkCommand, cdx:github:step:hasUntrustedInterpolation, cdx:github:step:if, cdx:github:step:interpolatedVars, cdx:github:step:mutatesRunnerState, cdx:github:step:name, cdx:github:step:outboundNetworkTools, cdx:github:step:referencesForkContext, cdx:github:step:referencesSensitiveContext, cdx:github:step:runnerStateTargets, cdx:github:step:sensitiveContextRefs, cdx:github:step:timeout, cdx:github:step:type, cdx:github:workflow:concurrencyGroup, cdx:github:workflow:dispatchSenderMatchBasis, cdx:github:workflow:dispatchSenderWorkflowFiles, cdx:github:workflow:dispatchSenderWorkflowNames, cdx:github:workflow:file, cdx:github:workflow:hasHighRiskTrigger, cdx:github:workflow:hasIdTokenWrite, cdx:github:workflow:hasIssueCommentTrigger, cdx:github:workflow:hasLocalDispatchSender, cdx:github:workflow:hasPullRequestTargetTrigger, cdx:github:workflow:hasPullRequestTrigger, cdx:github:workflow:hasRepositoryDispatchTrigger, cdx:github:workflow:hasWorkflowCallTrigger, cdx:github:workflow:hasWorkflowDispatchInputs, cdx:github:workflow:hasWorkflowDispatchTrigger, cdx:github:workflow:hasWorkflowRunTrigger, cdx:github:workflow:hasWritePermissions, cdx:github:workflow:isWorkflowCallProducer, cdx:github:workflow:name, cdx:github:workflow:repositoryDispatchTypes, cdx:github:workflow:triggers, cdx:github:workflow:workflowCallInputs, cdx:github:workflow:workflowCallOutputs, cdx:github:workflow:workflowCallSecrets, cdx:github:workflow:workflowDispatchInputs, cdx:github:workflow:workflowDispatchReceiverAliases, cdx:github:workflow:writeScopes
• GitHub action trust tags: cdx:actions:isOfficial, cdx:actions:isVerified
• GitLab CI: cdx:gitlab:config, cdx:gitlab:job:environment, cdx:gitlab:job:image, cdx:gitlab:job:name, cdx:gitlab:job:needs, cdx:gitlab:job:services, cdx:gitlab:job:stage, cdx:gitlab:stages
• Azure Pipelines: cdx:azure:config, cdx:azure:job:environment, cdx:azure:job:name, cdx:azure:job:pool:vmImage, cdx:azure:pool:vmImage, cdx:azure:stage:condition, cdx:azure:stage:dependsOn, cdx:azure:stage:name, cdx:azure:trigger:branches
• CircleCI: cdx:circleci:config, cdx:circleci:executor:name, cdx:circleci:job:branch:only, cdx:circleci:job:name, cdx:circleci:job:requires, cdx:circleci:orb:alias, cdx:circleci:workflow:name
• Jenkins: cdx:jenkins:agent, cdx:jenkins:agent:image, cdx:jenkins:file, cdx:jenkins:stage:name, cdx:jenkins:stage:parallel, cdx:jenkins:stage:when

Decision-oriented sub-groups

• Privilege / trust: cdx:github:workflow:hasWritePermissions, cdx:github:job:hasWritePermissions, cdx:github:workflow:hasIdTokenWrite, cdx:actions:isOfficial, cdx:actions:isVerified
• Execution surface: cdx:github:step:command, cdx:github:step:type, cdx:github:step:hasOutboundNetworkCommand, cdx:github:step:mutatesRunnerState, cdx:github:reusableWorkflow:uses, cdx:gitlab:job:image, cdx:gitlab:job:services, cdx:azure:job:pool:vmImage, cdx:circleci:orb:alias, cdx:jenkins:agent:image
• Reproducibility / control flow: cdx:github:workflow:triggers, cdx:github:job:needs, cdx:azure:stage:dependsOn, cdx:azure:stage:condition, cdx:circleci:job:requires, cdx:jenkins:stage:when, cdx:jenkins:stage:parallel
• Environment / targeting: cdx:github:job:environment, cdx:github:job:isSelfHosted, cdx:github:job:runner, cdx:github:workflow:workflowDispatchInputs, cdx:gitlab:job:environment, cdx:azure:job:environment, cdx:azure:trigger:branches, cdx:circleci:job:branch:only

Compact operational reference

Key	Scope	Value type	Typical values	When emitted	Why it matters	Policy readiness
cdx:github:action:isShaPinned	step	boolean string	"true", "false"	On uses: steps in GitHub Actions workflows	Primary mutable-vs-immutable trust signal for third-party actions	Hard deny
cdx:github:action:versionPinningType	step	enum string	sha, tag, branch	On uses: steps in GitHub Actions workflows	More expressive companion to isShaPinned; lets policies distinguish branch and tag references	Warning / triage
cdx:github:workflow:hasWritePermissions	workflow + component	boolean string	"true", "false"	When workflow permissions are parsed	Privilege amplifier for other risky signals	Hard deny
cdx:github:workflow:hasIdTokenWrite	workflow + component	boolean string	"true", "false"	When id-token: write is present	High-signal OIDC issuance capability	Hard deny
cdx:github:job:hasIdTokenWrite	job + component	boolean string	"true", "false"	When a job grants id-token: write	Captures narrower job-scoped OIDC issuance that would otherwise be missed	Hard deny
cdx:github:job:hasWritePermissions	job	boolean string	"true", "false"	When job-level permissions are parsed	Captures narrower but still powerful write scope	Hard deny
cdx:github:job:isSelfHosted	job + component	boolean string	"true", "false"	When a job targets a self-hosted runner label	Important trust-boundary signal for internal network access and runner persistence	Hard deny
cdx:github:workflow:writeScopes	workflow + component	list string	contents,id-token	When workflow or effective job permissions grant specific write scopes	Improves explainability and allows scope-specific policy rules	Warning / triage
cdx:github:step:command	step	string	npm ci && npm test	On run: steps	Direct execution surface useful for review and explainability	Context only
cdx:github:workflow:triggers	workflow + component	list string	push,pull_request	When workflow triggers are present	Helps constrain where other risks are reachable	Warning / triage
cdx:github:workflow:hasPullRequestTrigger	workflow + component	boolean string	"true", "false"	When the workflow includes the exact pull_request trigger	Lets policies avoid substring matches and distinguish exact untrusted trigger semantics	Hard deny
cdx:github:workflow:hasPullRequestTargetTrigger	workflow + component	boolean string	"true", "false"	When the workflow includes the exact pull_request_target trigger	Strong signal for privileged PR-driven execution	Hard deny
cdx:github:workflow:hasIssueCommentTrigger	workflow + component	boolean string	"true", "false"	When the workflow includes the exact issue_comment trigger	Useful for trigger-gated rules and manual-approval requirements	Hard deny
cdx:github:workflow:hasWorkflowRunTrigger	workflow + component	boolean string	"true", "false"	When the workflow includes the exact workflow_run trigger	Helps distinguish follow-on workflow chaining from ordinary branch triggers	Hard deny
cdx:github:workflow:hasWorkflowCallTrigger	workflow + component	boolean string	"true", "false"	When the workflow is designed to be invoked as a reusable workflow producer	Separates producer-side reusable workflow definitions from normal push/PR pipelines	Warning / triage
cdx:github:workflow:hasWorkflowDispatchInputs	workflow + component	boolean string	"true", "false"	When workflow_dispatch.inputs are declared	Highlights user-controlled inputs that can become initial-access or execution primitives	Warning / triage
cdx:github:workflow:workflowDispatchInputs	workflow + component	list string	target,version	When workflow_dispatch.inputs are declared	Lets policies and triage quickly see which user-controlled inputs exist	Context only
cdx:github:checkout:persistCredentials	step	boolean string	"true","false"	When actions/checkout step lacks persist-credentials or sets the attribute to true	Exposes GITHUB_TOKEN to subsequent steps	Warning / triage
cdx:github:cache:key	step	string	npm-${{ hashFiles('**/package-lock.json') }}	Cache key used in actions/cache		Context only
cdx:github:cache:keyUsesHashFiles	step	boolean string	"true", "false"	When the cache key is content-addressed with hashFiles(...)	Helps distinguish safer content-addressed caches from broader or mutable cache key patterns	Warning / triage
cdx:github:cache:path	step	string	~/.npm,node_modules	Cache path		Context only
cdx:github:cache:restoreKeys	step	list string	npm-,node-modules-	Comma-separated restore-key fallback patterns from actions/cache	Cache poisoning risk context	Context only
cdx:github:cache:hasRestoreKeys	step	boolean string	"true", "false"	When restore-keys are configured on a cache action	Makes cache fallback behavior explicit and easy to consume in rules	Warning / triage
cdx:github:step:hasUntrustedInterpolation	step	boolean string	"true","false"	Direct interpolation of github.event._ or inputs._ into run: blocks.	Enables command injection	Hard deny
cdx:github:step:interpolatedVars	step	list string	github.event.pull_request.title			Warning / triage
cdx:github:step:mutatesRunnerState	step	boolean string	"true","false"	When a step writes to GITHUB_ENV, GITHUB_PATH, or GITHUB_OUTPUT	Highlights persistence and downstream execution tampering within a workflow	Hard deny
cdx:github:step:runnerStateTargets	step	list string	GITHUB_ENV,GITHUB_OUTPUT	When runner-state mutation is detected	Adds precise evidence about which mutable workflow channels were touched	Warning / triage
cdx:github:step:dispatchesWorkflow	step	boolean string	"true","false"	When a step triggers workflow_dispatch / repository_dispatch via CLI, API, helper action, or actions/github-script	High-signal lateral-movement primitive across workflows and repositories	Hard deny
cdx:github:step:dispatchKinds	step	list string	workflow_dispatch,repository_dispatch	When dispatch behavior is detected	Distinguishes manual workflow invocations from custom repository events	Warning / triage
cdx:github:step:dispatchTargets	step	list string	repo:org/repo,workflow:release.yml	When dispatch targets can be extracted from step configuration or script body	Preserves concrete downstream blast-radius evidence	Context only
cdx:github:step:hasLocalDispatchReceiver	step	boolean string	"true","false"	When the dispatch target can be matched to a unique local workflow receiver definition	Converts a generic dispatch into an explicit sender → receiver workflow edge	Hard deny
cdx:github:step:dispatchReceiverWorkflowFiles	step	list string	.github/workflows/release.yml	When local receiver workflow files are matched	Preserves the exact downstream workflow files reached by the sender	Context only
cdx:github:step:dispatchReceiverMatchBasis	step	list string	workflow:release.yml,repository_dispatch:promote	When sender-target correlation succeeds	Explains exactly why a local receiver match was considered high-confidence	Warning / triage
cdx:github:step:referencesForkContext	step	boolean string	"true","false"	When a step references fork/head-repository workflow context	Strong signal for fork-to-privileged workflow routing	Hard deny
cdx:github:step:hasOutboundNetworkCommand	step	boolean string	"true","false"	When a step invokes tools such as curl, wget, scp, rsync, or Invoke-WebRequest	Useful exfiltration and command-and-control precursor signal	Warning / triage
cdx:github:step:outboundNetworkTools	step	list string	curl,wget	When outbound network tools are detected	Improves explainability for exfiltration-oriented rules	Context only
cdx:github:step:referencesSensitiveContext	step	boolean string	"true","false"	When a run command references secret-like env vars, secrets.*, or token/OIDC context	Strong exfiltration/credential-use indicator when combined with outbound commands	Hard deny
cdx:github:step:sensitiveContextRefs	step	list string	env:API_TOKEN,context:secrets	When sensitive context references are detected	Retains exactly which secret-bearing contexts were observed	Warning / triage
cdx:github:workflow:hasHighRiskTrigger	workflow + component	boolean string	"true","false"	When workflow has these triggers: "pull_request_target","issue_comment","workflow_run"	Enables privilege escalation	Hard deny
cdx:actions:isOfficial	step	boolean string	"true", "false"	On GitHub action components	Distinguishes first-party from third-party action sources	Warning / triage
cdx:actions:isVerified	step	boolean string	"true", "false"	On GitHub action components	Helpful trust signal but not sufficient on its own	Warning / triage
cdx:github:reusableWorkflow:uses	reusable workflow	string	org/repo/.github/workflows/release.yml@main	When a job invokes a reusable workflow via jobs.<id>.uses	Makes reusable workflow trust boundaries visible to policy engines	Hard deny
cdx:github:reusableWorkflow:isExternal	reusable workflow	boolean string	"true","false"	When the reusable workflow is sourced from another repository	Distinguishes internal/local workflow composition from external trust edges	Hard deny
cdx:github:reusableWorkflow:secretsInherit	reusable workflow	boolean string	"true","false"	When secrets: inherit is used on a reusable workflow call	Signals credential propagation across workflow boundaries	Hard deny
cdx:github:reusableWorkflow:isShaPinned	reusable workflow	boolean string	"true","false"	When a reusable workflow ref is pinned to a commit SHA	Immutable pinning signal for reusable workflow supply-chain trust	Hard deny
cdx:github:workflow:isWorkflowCallProducer	workflow + component	boolean string	"true","false"	When the current workflow exposes a workflow_call interface	Important provenance signal for reusable workflow producers and their public trust surface	Warning / triage
cdx:github:workflow:workflowCallInputs	workflow + component	list string	target,release_tag	When a reusable workflow producer declares workflow_call.inputs	Enumerates caller-controlled producer inputs for review and policy	Context only
cdx:github:workflow:workflowCallSecrets	workflow + component	list string	release_token	When a reusable workflow producer declares workflow_call.secrets	Reveals which secrets the producer expects from callers	Hard deny
cdx:github:workflow:workflowCallOutputs	workflow + component	list string	image_tag	When a reusable workflow producer declares workflow_call.outputs	Exposes the interface surface exported back to callers	Context only
cdx:github:workflow:repositoryDispatchTypes	workflow	list string	promote,release-ready	When a workflow declares repository_dispatch.types	Makes local repository_dispatch receivers explicit and matchable	Warning / triage
cdx:github:workflow:workflowDispatchReceiverAliases	workflow	list string	release.yml,release,Release workflow	When workflow receiver aliases are derived from file/name	Supports high-confidence matching between sender steps and local workflow_dispatch receivers	Context only
cdx:github:workflow:hasLocalDispatchSender	workflow	boolean string	"true","false"	When a local sender step was matched to this workflow as a receiver	Preserves the reverse edge for receiver-focused triage	Warning / triage
cdx:gitlab:job:image	job	string	node:20-alpine	When GitLab job images are defined	Exposes execution environment and provenance	Warning / triage
cdx:gitlab:job:services	job	list string	postgres:14,redis:7	When GitLab service sidecars are declared	Highlights additional runtime trust edges	Warning / triage
cdx:azure:pool:vmImage	workflow	string	ubuntu-latest	When a workflow-level pool is set	Baseline runner selection for all jobs	Warning / triage
cdx:azure:job:pool:vmImage	job	string	windows-latest	When a job overrides the workflow-level pool	Important job-level override; match both Azure pool keys in policy	Warning / triage
cdx:circleci:orb:alias	step	string	node/default	When CircleCI orbs are used	Third-party execution surface and trust boundary	Warning / triage
cdx:jenkins:agent:image	stage	string	maven:3.9-eclipse-temurin-21	When Jenkins stages use Docker agents	Useful for runtime provenance and image policy gates	Warning / triage

High-value combinations

• cdx:github:action:isShaPinned=false + cdx:github:workflow:hasWritePermissions=true
• cdx:github:action:isShaPinned=false + cdx:github:job:hasWritePermissions=true
• cdx:github:workflow:hasIdTokenWrite=true + cdx:actions:isOfficial=false
• cdx:github:step:type=run + cdx:github:job:hasWritePermissions=true
• cdx:gitlab:job:image present + cdx:gitlab:job:services present for untrusted pipeline paths
• cdx:azure:trigger:branches absent + self-hosted or privileged pool policy match
• cdx:circleci:orb:alias present + cdx:circleci:job:branch:only absent
• cdx:jenkins:agent:image present + cdx:jenkins:stage:when absent for deployment stages

Example payload fragment

{
  "name": "actions/setup-node",
  "type": "application",
  "purl": "pkg:github/actions/setup-node@v3",
  "properties": [
    { "name": "cdx:github:action:uses", "value": "actions/setup-node@v3" },
    { "name": "cdx:github:action:versionPinningType", "value": "tag" },
    { "name": "cdx:github:action:isShaPinned", "value": "false" },
    { "name": "cdx:github:workflow:hasWritePermissions", "value": "true" },
    { "name": "cdx:actions:isOfficial", "value": "true" }
  ]
}

Alias and overlap notes

• Prefer matching both cdx:github:action:isShaPinned and cdx:github:action:versionPinningType when possible; the former is the convenience boolean and the latter carries more nuance.
• Match both cdx:azure:pool:vmImage (workflow-level default) and cdx:azure:job:pool:vmImage (job-level override). Job-level settings take precedence when present.

Package manager and language ecosystems

Authoritative grouped index

• npm/pnpm: cdx:npm:artifactIntegrity, cdx:npm:artifactShasum, cdx:npm:bin, cdx:npm:binPaths, cdx:npm:buildScripts, cdx:npm:compressedCadence, cdx:npm:cpu, cdx:npm:deprecated, cdx:npm:deprecation_notice, cdx:npm:gypfile, cdx:npm:hasInstallScript, cdx:npm:hasObfuscatedLifecycleScript, cdx:npm:hasSuspiciousLifecycleScript, cdx:npm:has_binary, cdx:npm:inBundle, cdx:npm:inDepBundle, cdx:npm:installLinks, cdx:npm:isLink, cdx:npm:isRegistryDependency, cdx:npm:isWorkspace, cdx:npm:is_workspace, cdx:npm:lastModifiedTime, cdx:npm:libc, cdx:npm:lifecycleExecutionIndicators, cdx:npm:lifecycleIndicatorMap, cdx:npm:lifecycleNetworkIndicators, cdx:npm:lifecycleObfuscationIndicators, cdx:npm:maintainerOverlapCount, cdx:npm:maintainerOverlapRatio, cdx:npm:maintainerSet, cdx:npm:maintainerSetCount, cdx:npm:maintainerSetDrift, cdx:npm:maintainerSetPartialDrift, cdx:npm:nameMismatchError, cdx:npm:native_addon, cdx:npm:native_deps, cdx:npm:obfuscatedLifecycleScripts, cdx:npm:os, cdx:npm:package:development, cdx:npm:package:optional, cdx:npm:package:peer, cdx:npm:package:type-only, cdx:npm:package_json, cdx:npm:packageCreatedTime, cdx:npm:priorMaintainerSet, cdx:npm:priorMaintainerSetCount, cdx:npm:priorPublishTime, cdx:npm:priorPublisher, cdx:npm:priorVersion, cdx:npm:provenanceDigest, cdx:npm:provenanceKeyId, cdx:npm:provenancePredicateType, cdx:npm:provenanceSignature, cdx:npm:provenanceUrl, cdx:npm:publishTime, cdx:npm:publisher, cdx:npm:publisherDrift, cdx:npm:publisherEmail, cdx:npm:releaseCadenceCompressionRatio, cdx:npm:releaseGapBaselineDays, cdx:npm:releaseGapDays, cdx:npm:releaseGapSampleSize, cdx:npm:resolvedPath, cdx:npm:risky_scripts, cdx:npm:scripts, cdx:npm:suspiciousLifecycleScripts, cdx:npm:trustedPublishing, cdx:npm:versionCount, cdx:npm:versionMismatchError, cdx:pnpm:alias
• Python: cdx:pip:markers, cdx:pip:structuredMarkers, cdx:pypi:artifactDigestBlake2b256, cdx:pypi:artifactDigestMd5, cdx:pypi:artifactDigestSha256, cdx:pypi:compressedCadence, cdx:pypi:extras, cdx:pypi:latest_version, cdx:pypi:packageCreatedTime, cdx:pypi:priorPublishTime, cdx:pypi:priorPublisher, cdx:pypi:priorUploaderSet, cdx:pypi:priorUploaderSetCount, cdx:pypi:priorVersion, cdx:pypi:provenanceDigest, cdx:pypi:provenanceKeyId, cdx:pypi:provenancePredicateType, cdx:pypi:provenanceSignature, cdx:pypi:provenanceUrl, cdx:pypi:publishTime, cdx:pypi:publisher, cdx:pypi:publisherDrift, cdx:pypi:registry, cdx:pypi:releaseCadenceCompressionRatio, cdx:pypi:releaseGapBaselineDays, cdx:pypi:releaseGapDays, cdx:pypi:releaseGapSampleSize, cdx:pypi:requiresPython, cdx:pypi:resolved_from, cdx:pypi:trustedPublishing, cdx:pypi:uploaderOverlapCount, cdx:pypi:uploaderOverlapRatio, cdx:pypi:uploaderSet, cdx:pypi:uploaderSetCount, cdx:pypi:uploaderSetDrift, cdx:pypi:uploaderSetPartialDrift, cdx:pypi:uploaderVerified, cdx:pypi:versionCount, cdx:pypi:versionSpecifiers, cdx:pyproject:group, cdx:python:requires_python, cdx:pixi:build, cdx:pixi:build_number, cdx:pixi:operating_system, cdx:pylock:* (lock_version, environments, dependency_groups, default_groups, created_by, marker, index, dependencies, vcs, directory, archive, sdist, wheels, attestation_identities, tool, and cdx:pylock:file:*)
• Ruby: cdx:gem:executables, cdx:gem:gemUri, cdx:gem:platform, cdx:gem:prerelease, cdx:gem:remote, cdx:gem:remoteBranch, cdx:gem:remoteRevision, cdx:gem:remoteTag, cdx:gem:rubyVersionSpecifiers, cdx:gem:versionSpecifiers, cdx:gem:yanked
• Rust: cdx:cargo:artifactDigestSha256, cdx:cargo:binNames, cdx:cargo:buildDependencyNames, cdx:cargo:buildScript, cdx:cargo:buildScriptCapabilities, cdx:cargo:buildScriptIndicators, cdx:cargo:compressedCadence, cdx:cargo:crate_id, cdx:cargo:crateSize, cdx:cargo:defaultFeatures, cdx:cargo:dependencyFeatures, cdx:cargo:dependencyKind, cdx:cargo:edition, cdx:cargo:features, cdx:cargo:git, cdx:cargo:gitBranch, cdx:cargo:gitRev, cdx:cargo:gitTag, cdx:cargo:hasBuildDependencies, cdx:cargo:hasBuildScript, cdx:cargo:hasDevDependencies, cdx:cargo:hasLib, cdx:cargo:hasNativeBuild, cdx:cargo:hasTargetDependencies, cdx:cargo:latest_version, cdx:cargo:manifestMode, cdx:cargo:nativeBuildIndicators, cdx:cargo:optional, cdx:cargo:ownerSet, cdx:cargo:ownerSetCount, cdx:cargo:package, cdx:cargo:packageCreatedTime, cdx:cargo:path, cdx:cargo:priorPublishTime, cdx:cargo:priorPublisher, cdx:cargo:priorVersion, cdx:cargo:provenanceDigest, cdx:cargo:provenanceKeyId, cdx:cargo:provenancePredicateType, cdx:cargo:provenanceSignature, cdx:cargo:provenanceUrl, cdx:cargo:publishTime, cdx:cargo:publisher, cdx:cargo:publisherDrift, cdx:cargo:publisherOverlapCount, cdx:cargo:publisherOverlapRatio, cdx:cargo:publisherSet, cdx:cargo:publisherSetCount, cdx:cargo:registry, cdx:cargo:releaseCadenceCompressionRatio, cdx:cargo:releaseGapBaselineDays, cdx:cargo:releaseGapDays, cdx:cargo:releaseGapSampleSize, cdx:cargo:releaseProfiles, cdx:cargo:rust_version, cdx:cargo:rustVersion, cdx:cargo:scope, cdx:cargo:target, cdx:cargo:trustedPublishing, cdx:cargo:usesMaturin, cdx:cargo:versionCount, cdx:cargo:workspaceDependency, cdx:cargo:workspaceMembers, cdx:cargo:workspaceRoot, cdx:cargo:yanked, cdx:maturin:*, cdx:rust:buildTool
• Rusi Rust Evinse: cdx:rusi:schemaVersion, cdx:rusi:toolVersion, cdx:rusi:rustcVersion, cdx:rusi:cargoVersion, cdx:rusi:host, cdx:rusi:backend, cdx:rusi:analysisScope, cdx:rusi:callGraphMode, cdx:rusi:dataFlowMode, cdx:rusi:packageCount, cdx:rusi:fileCount, cdx:rusi:importCount, cdx:rusi:declarationCount, cdx:rusi:usageCount, cdx:rusi:securitySignalCount, cdx:rusi:cryptoLibraryCount, cdx:rusi:cryptoComponentCount, cdx:rusi:cryptoFindingCount, cdx:rusi:callGraphNodeCount, cdx:rusi:callGraphEdgeCount, cdx:rusi:dataFlowNodeCount, cdx:rusi:dataFlowEdgeCount, cdx:rusi:dataFlowSliceCount, cdx:rusi:importPath, cdx:rusi:importAlias, cdx:rusi:usageKind, cdx:rusi:dataFlowCategories, cdx:rusi:dataFlowRuleName, cdx:rusi:securitySignalCategory, cdx:rusi:securitySignalSeverity, cdx:rusi:cryptoFindingCategory, cdx:rusi:cryptoFindingSeverity
• Go: cdx:go:creation_time, cdx:go:deprecated, cdx:go:indirect, cdx:go:local_dir, cdx:go:toolchain
• Golem Go Evinse: cdx:golem:toolVersion, cdx:golem:callGraphMode, cdx:golem:dataFlowMode, cdx:golem:dataFlowCallGraphMode, cdx:golem:noRecurse, cdx:golem:includeAllFlows, cdx:golem:packageCount, cdx:golem:moduleCount, cdx:golem:fileCount, cdx:golem:generatedFileCount, cdx:golem:importCount, cdx:golem:declarationCount, cdx:golem:usageCount, cdx:golem:runtimeUsageCount, cdx:golem:testUsageCount, cdx:golem:benchmarkUsageCount, cdx:golem:fuzzUsageCount, cdx:golem:exampleUsageCount, cdx:golem:buildDirectiveCount, cdx:golem:nativeArtifactCount, cdx:golem:securitySignalCount, cdx:golem:goModReplaceCount, cdx:golem:goModExcludeCount, cdx:golem:vendorModuleCount, cdx:golem:workspaceModuleCount, cdx:golem:privateModuleHintCount, cdx:golem:licenseFileModuleCount, cdx:golem:callGraphNodeCount, cdx:golem:callGraphEdgeCount, cdx:golem:buildDirectiveKinds, cdx:golem:nativeArtifactKinds, cdx:golem:securitySignalCategories, cdx:golem:securitySignalSeverities, cdx:golem:generatorKinds, cdx:golem:goDirectiveVersion, cdx:golem:toolchainDirective, cdx:golem:goWorkPresent, cdx:golem:vendorDirectoryPresent, cdx:golem:goGenerateCount, cdx:golem:goEmbedCount, cdx:golem:replaceModule, cdx:golem:replaceTargetPathKind, cdx:golem:localReplacementPresent, cdx:golem:excludeModule, cdx:golem:vendored, cdx:golem:privateModuleCandidate, cdx:golem:licenseFileCount, cdx:golem:licenseFiles, cdx:golem:replacementModule, cdx:golem:localReplacement, cdx:golem:modulePath, cdx:golem:goVersion, cdx:golem:mainModule, cdx:golem:securitySignalCategory, cdx:golem:securitySignalSeverity, cdx:golem:importDirect, cdx:golem:importAliasKind, cdx:golem:symbolKind, cdx:golem:usageKind, cdx:golem:usageScope, cdx:golem:usageScopes, cdx:golem:testOnly, cdx:golem:importOccurrenceCount, cdx:golem:symbolCallOccurrenceCount, cdx:golem:symbolReferenceOccurrenceCount, cdx:golem:occurrenceEvidenceKinds
• Collider: cdx:collider:dependencyKind, cdx:collider:hasWrapHash, cdx:collider:origin, cdx:collider:originHost, cdx:collider:originSanitized, cdx:collider:originScheme, cdx:collider:wrapHash, cdx:collider:wrapHashInvalid
• .NET: cdx:dotnet:assembly_name, cdx:dotnet:assembly_version, cdx:dotnet:azure_functions_version, cdx:dotnet:hint_path, cdx:dotnet:project_guid, cdx:dotnet:target_framework
• Java: cdx:maven:shaded, cdx:maven:unshadedNamespaces, cdx:gradle:GradleRootPath
• Nix: cdx:nix:flake_dir, cdx:nix:input_url, cdx:nix:last_modified, cdx:nix:nar_hash, cdx:nix:ref, cdx:nix:revision
• Swift: cdx:swift:localCheckoutPath, cdx:swift:packageName
• CocoaPods: cdx:pods:PodName, cdx:pods:Subspec, cdx:pods:podspecLocation, cdx:pods:projectDir
• Dart pub: cdx:pub:registry
• Deno: cdx:deno:source, cdx:deno:jsrKey, cdx:deno:integrity

Decision-oriented sub-groups

• Provenance / source: cdx:npm:isRegistryDependency, cdx:npm:resolvedPath, cdx:pypi:registry, cdx:pypi:resolved_from, cdx:gem:remote, cdx:gem:remoteRevision, cdx:cargo:git, cdx:cargo:gitRev, cdx:cargo:path, cdx:cargo:registry, cdx:go:local_dir, cdx:golem:localReplacement, cdx:golem:replacementModule, cdx:golem:privateModuleCandidate, cdx:golem:vendored, cdx:nix:input_url, cdx:swift:localCheckoutPath, cdx:pods:projectDir, cdx:pub:registry, cdx:deno:source, cdx:collider:origin, cdx:collider:originScheme, cdx:collider:originHost, cdx:collider:originSanitized
• Execution surface: cdx:npm:hasInstallScript, cdx:npm:risky_scripts, cdx:npm:native_addon, cdx:npm:native_deps, cdx:gem:executables, cdx:cargo:features, cdx:cargo:hasBuildScript, cdx:cargo:hasNativeBuild, cdx:cargo:nativeBuildIndicators, cdx:cargo:buildScriptCapabilities, cdx:cargo:buildScriptIndicators, cdx:rust:buildTool, cdx:maturin:*, cdx:golem:goGenerateCount, cdx:golem:goEmbedCount, cdx:golem:nativeArtifactCount, cdx:golem:securitySignalCategory, cdx:golem:securitySignalSeverity, cdx:rusi:usageKind, cdx:rusi:cryptoFindingCategory, cdx:rusi:cryptoFindingSeverity
• Privilege / trust: cdx:npm:nameMismatchError, cdx:npm:versionMismatchError, cdx:gem:yanked, cdx:cargo:yanked, cdx:cargo:trustedPublishing, cdx:go:deprecated, cdx:golem:securitySignalSeverity, cdx:golem:localReplacement, cdx:maven:shaded, cdx:collider:originSanitized, cdx:rusi:securitySignalSeverity
• Reproducibility / drift: cdx:pypi:latest_version, cdx:gem:remoteBranch, cdx:gem:remoteTag, cdx:cargo:priorVersion, cdx:cargo:publishTime, cdx:cargo:priorPublishTime, cdx:cargo:publisherDrift, cdx:cargo:releaseGapDays, cdx:cargo:releaseGapBaselineDays, cdx:cargo:releaseCadenceCompressionRatio, cdx:nix:nar_hash, cdx:nix:revision, cdx:nix:last_modified, cdx:go:creation_time, cdx:collider:hasWrapHash, cdx:collider:wrapHash, cdx:collider:wrapHashInvalid
• Environment / targeting: cdx:npm:cpu, cdx:npm:os, cdx:npm:libc, cdx:pip:markers, cdx:python:requires_python, cdx:pypi:requiresPython, cdx:pixi:operating_system, cdx:dotnet:target_framework, cdx:dotnet:azure_functions_version, cdx:gem:platform, cdx:cargo:rust_version, cdx:cargo:rustVersion, cdx:cargo:target

Compact operational reference

Key	Scope	Value type	Typical values	When emitted	Why it matters	Policy readiness
cdx:npm:hasInstallScript	component	boolean string	"true", "false"	When risky npm lifecycle hooks are present	Captures install-time code execution risk	Hard deny
cdx:npm:bin	component	list string	license-report, ng	When npm package metadata declares one or more executable bin commands	Lets consumers identify CLI execution surface; cdxgen also uses it to match script-invoked commands to the owning package and keep such components required	Warning / triage
cdx:npm:has_binary	component	boolean string	"true"	When npm package metadata declares a bin entry	Quick boolean for packages exposing executable commands	Warning / triage
cdx:npm:binPaths	component	list string	node_modules/.bin/ng	When npm/arborist exposes installed binary link paths	Provides installed-path evidence for executable packages and supports command-to-package matching	Context only
cdx:npm:hasObfuscatedLifecycleScript	component	boolean string	"true", "false"	When install hooks combine encoded/obfuscated payload handling with execution or delivery primitives	High-confidence supply-chain abuse indicator for npm lifecycle hooks	Hard deny
cdx:npm:lifecycleObfuscationIndicators	component	list string	ast:buffer-base64,long-base64-literal	When inline hook commands or referenced JS files contain encoded loader indicators	Makes hidden payload techniques visible to policy and triage	Warning / triage
cdx:npm:lifecycleExecutionIndicators	component	list string	ast:child-process,eval	When install hooks or referenced JS files expose execution primitives	Separates generic install hooks from active payload execution	Warning / triage
cdx:npm:lifecycleIndicatorMap	component	string	postinstall:ast:buffer-base64+ast:child-process	When lifecycle analysis can map indicators back to specific script names	Preserves script-level evidence without storing full payloads	Context only
cdx:npm:risky_scripts	component	list string	preinstall,postinstall	When risky lifecycle hooks are detected	Human-readable explanation for why hasInstallScript was set	Warning / triage
cdx:npm:buildScripts	metadata component	list string	build, compile	When a package's scripts field contains build-related script names (matching build, compile, bundle, pack, dist, watch, or similar)	Surfaces build toolchain invocation surface on the root component; useful for identifying which packages drive the build pipeline and for policy decisions about build-time risk	Context only
cdx:npm:isRegistryDependency	component	boolean string	"true", "false"	For npm components with resolvable source type	Distinguishes registry dependencies from git/file/local/workspace sources	Hard deny
cdx:npm:native_addon	component	boolean string	"true", "false"	When a package builds native code	Highlights additional build and execution surface	Warning / triage
cdx:npm:nameMismatchError	component	string	Expected 'foo', found 'foo-esm'	When name resolution mismatches are detected	Useful dependency-confusion and tampering signal	Hard deny
cdx:npm:versionMismatchError	component	string	Resolved 3.0.0, expected ^2.0	When locked/resolved version diverges from expectation	Flags drift, corruption, or surprising resolution	Hard deny
cdx:npm:trustedPublishing	component	boolean string	"true"	When npm registry metadata exposes attestation/provenance evidence for the resolved version	Strong positive signal that the published version includes registry-visible provenance evidence	Warning / triage
cdx:npm:provenanceUrl	component	URL string	https://registry.npmjs.org/-/npm/v1/attestations/...	When npm exposes an attestation or provenance URL for the resolved version	Useful provenance pivot for attestations, explainability, and downstream verification	Context only
cdx:npm:provenanceDigest	component	list string	sha256:abc...,sha512:def...	When npm provenance metadata exposes subject or attestation digests	Gives audit rules an exact immutable evidence token beyond the registry URL	Context only
cdx:npm:provenanceKeyId	component	list string	sigstore-npm-key	When npm provenance metadata exposes signature key identifiers	Supports key-based allowlists, trust pinning, and explainability	Warning / triage
cdx:npm:provenanceSignature	component	list string	MEUCIQD...	When npm provenance metadata exposes raw signature values	Retains exact cryptographic evidence for downstream verification	Context only
cdx:npm:provenancePredicateType	component	list string	https://slsa.dev/provenance/v1	When npm provenance metadata exposes a predicate type	Lets policies distinguish SLSA/in-toto style attestations	Context only
cdx:npm:artifactIntegrity	component	string	sha512-...	When npm dist.integrity is present	Exact package artifact integrity token useful for verification and incident response	Warning / triage
cdx:npm:artifactShasum	component	string	deadbeef...	When npm dist.shasum is present	Additional artifact fingerprint for audit evidence and correlation	Context only
cdx:npm:publisher	component	string	octo-maintainer	When npm version metadata exposes the publishing identity	Helpful provenance and publisher-trust context	Context only
cdx:npm:publisherEmail	component	string	maintainer@example.com	When npm version metadata exposes publisher email	Additional provenance context; not strong enough as a standalone gate	Context only
cdx:npm:publishTime	component	timestamp	2026-04-01T10:00:00.000Z	When npm registry timestamps the resolved version	Useful for recency, drift, and incident scoping	Warning / triage
cdx:npm:packageCreatedTime	component	timestamp	2024-01-01T10:00:00.000Z	When npm registry exposes package creation time	Distinguishes mature packages from brand-new packages for drift heuristics	Context only
cdx:npm:lastModifiedTime	component	timestamp	2026-04-01T10:00:00.000Z	When npm registry exposes the latest modification time	Useful for release cadence and incident scoping	Context only
cdx:npm:versionCount	component	number string	12	Derived from npm registry release history	Helps recent-release and publisher-drift heuristics ignore tiny histories	Context only
cdx:npm:priorVersion	component	string	1.2.2	When a prior publish exists before the resolved version	Useful pivot for change review and comparison	Context only
cdx:npm:priorPublishTime	component	timestamp	2026-03-01T10:00:00.000Z	When a prior publish exists before the resolved version	Supports recency and release-gap analysis	Context only
cdx:npm:priorPublisher	component	string	previous-publisher	When npm version history exposes the previous publisher	Useful for publisher-change review	Warning / triage
cdx:npm:publisherDrift	component	boolean string	"true"	When the resolved version publisher differs from the prior release publisher	Conservative drift signal for mature packages	Warning / triage
cdx:npm:maintainerSet	component	list string	alice, alice@example.com	When npm version metadata exposes maintainer identities	Useful for maintainer continuity review	Context only
cdx:npm:priorMaintainerSet	component	list string	bob, bob@example.com	When a prior version exposes maintainer identities	Useful comparison pivot for maintainer-set drift	Context only
cdx:npm:maintainerSetDrift	component	boolean string	"true"	When current and prior maintainer identity sets are fully disjoint	Conservative maintainer drift signal for mature packages	Warning / triage
cdx:npm:maintainerSetPartialDrift	component	boolean string	"true"	When current and prior maintainer identity sets partially overlap but still change	Low-severity maintainer churn signal for mature packages	Warning / triage
cdx:npm:maintainerOverlapCount	component	number string	1	Derived from the shared identities between current and prior maintainer sets	Explainability signal for maintainer continuity	Context only
cdx:npm:maintainerOverlapRatio	component	number string	0.33	Shared-identity overlap divided by the maintainer-set union	Helps distinguish partial churn from full continuity or full drift	Context only
cdx:npm:releaseGapDays	component	number string	240.00	Derived from the gap between the current and previous release	Useful for dormant-package revival and cadence anomaly review	Warning / triage
cdx:npm:releaseGapBaselineDays	component	number string	12.00	Derived from older adjacent release gaps before the current release	Provides cadence baseline for anomaly detectors	Context only
cdx:npm:releaseGapSampleSize	component	number string	4	Count of prior release gaps used to compute the baseline	Helps policies ignore thin release histories	Context only
cdx:npm:releaseCadenceCompressionRatio	component	number string	0.11	Derived from current gap ÷ baseline gap when enough history exists	Explainability signal for materially faster-than-usual releases	Context only
cdx:npm:compressedCadence	component	boolean string	"true"	When the current release arrives materially faster than the established cadence baseline	Low-severity cadence anomaly signal for mature packages	Warning / triage
cdx:npm:package:development	component	boolean string	"true"	When an npm package is marked as dev: true or devOptional: true in package-lock metadata	Distinguishes development-only npm packages from optional runtime packages	Context only
cdx:npm:package:optional	component	boolean string	"true"	When an npm package is marked as optional: true in package-lock metadata	Distinguish optional packages	Context only
cdx:npm:package:peer	component	boolean string	"true"	When an npm package is marked as a peer dependency in package-lock metadata	Distinguish peer dependencies	Context only
cdx:npm:package:type-only	component	boolean string	"true"	When an npm package is identified as a type-only package based on static analysis	Distinguish type-only dependencies from required and optional dependencies	Context only
cdx:npm:isWorkspace	component	boolean string	"true", "false"	For workspace members	Preferred workspace indicator	Context only
cdx:npm:is_workspace	component	boolean string	"true", "false"	Legacy/alternate workspace spelling	Keep in policy allowlists for compatibility	Context only
cdx:pypi:registry	component	URL string	https://internal-pypi.example.com/simple	When a non-default Python registry is used	Strong allowlist / denylist input for dependency origin policy	Hard deny
cdx:pypi:trustedPublishing	component	boolean string	"true"	When PyPI release metadata exposes attestation/provenance evidence for the resolved version	Strong positive provenance signal for trusted publishing or attestations	Warning / triage
cdx:pypi:provenanceUrl	component	URL string	https://pypi.org/integrity/.../provenance	When PyPI exposes a provenance or integrity URL for a resolved artifact	Useful provenance pivot for downstream verification	Context only
cdx:pypi:provenanceDigest	component	list string	sha256:abc...	When PyPI provenance or attestation metadata exposes digests	Gives audit rules exact immutable provenance evidence	Context only
cdx:pypi:provenanceKeyId	component	list string	sigstore-pypi-key	When PyPI provenance or attestation metadata exposes signature key identifiers	Supports key-based allowlists and trust explainability	Warning / triage
cdx:pypi:provenanceSignature	component	list string	c2lnbmF0dXJl	When PyPI provenance or attestation metadata exposes raw signatures	Retains exact cryptographic evidence for downstream verification	Context only
cdx:pypi:provenancePredicateType	component	list string	https://docs.pypi.org/attestations/publish/v1	When PyPI provenance metadata exposes a predicate type	Helps policies distinguish attestation formats	Context only
cdx:pypi:artifactDigestSha256	component	list string	abcdef...	When PyPI release file metadata exposes SHA-256 digests	Exact release-file fingerprint useful for audit evidence and verification	Warning / triage
cdx:pypi:artifactDigestBlake2b256	component	list string	012345...	When PyPI release file metadata exposes BLAKE2b-256 digests	Additional artifact fingerprint for correlation and verification	Context only
cdx:pypi:artifactDigestMd5	component	list string	deadbeef...	When PyPI release file metadata exposes MD5 digests	Legacy integrity context; weaker than SHA-256 but still useful for correlation	Context only
cdx:pypi:publisher	component	string	trusted-publisher	When release metadata includes uploader identity	Helpful provenance context for triage and publisher reviews	Context only
cdx:pypi:uploaderVerified	component	boolean string	"true"	When PyPI release metadata marks the uploader as verified	Useful trust signal, but weaker than signed provenance	Warning / triage
cdx:pypi:publishTime	component	timestamp	2026-03-20T08:15:30.000Z	When PyPI release metadata includes upload timestamps	Useful for incident scoping, release recency, and drift analysis	Warning / triage
cdx:pypi:packageCreatedTime	component	timestamp	2025-12-20T08:15:30.000Z	Derived from the earliest known release upload time	Distinguishes mature packages from brand-new packages for drift heuristics	Context only
cdx:pypi:versionCount	component	number string	8	Derived from PyPI release history	Helps recent-release and drift heuristics avoid small-package false positives	Context only
cdx:pypi:priorVersion	component	string	1.9.0	When a prior release exists before the resolved version	Useful comparison pivot for audit and rollout review	Context only
cdx:pypi:priorPublishTime	component	timestamp	2025-12-20T08:15:30.000Z	When a prior release exists before the resolved version	Supports recency and release-gap analysis	Context only
cdx:pypi:priorPublisher	component	string	previous-uploader	When prior-release uploader identity is available	Useful for uploader-change review	Warning / triage
cdx:pypi:publisherDrift	component	boolean string	"true"	When current uploader identities differ from the prior release uploader set	Conservative uploader-drift signal for mature packages	Warning / triage
cdx:pypi:uploaderSet	component	list string	trusted-publisher	When PyPI release metadata exposes uploader identities	Useful for uploader continuity review	Context only
cdx:pypi:priorUploaderSet	component	list string	previous-uploader	When a prior release exposes uploader identities	Useful comparison pivot for uploader-set drift	Context only
cdx:pypi:uploaderSetDrift	component	boolean string	"true"	When current and prior uploader identity sets are fully disjoint	Conservative uploader-set drift signal for mature packages	Warning / triage
cdx:pypi:uploaderSetPartialDrift	component	boolean string	"true"	When current and prior uploader identity sets partially overlap but still change	Low-severity uploader churn signal for mature packages	Warning / triage
cdx:pypi:uploaderOverlapCount	component	number string	1	Derived from the shared identities between current and prior uploader sets	Explainability signal for uploader continuity	Context only
cdx:pypi:uploaderOverlapRatio	component	number string	0.33	Shared-identity overlap divided by the uploader-set union	Helps distinguish partial churn from full continuity or full drift	Context only
cdx:pypi:releaseGapDays	component	number string	240.00	Derived from the gap between the current and previous release	Useful for dormant-package revival and cadence anomaly review	Warning / triage
cdx:pypi:releaseGapBaselineDays	component	number string	12.00	Derived from older adjacent release gaps before the current release	Provides cadence baseline for anomaly detectors	Context only
cdx:pypi:releaseGapSampleSize	component	number string	4	Count of prior release gaps used to compute the baseline	Helps policies ignore thin release histories	Context only
cdx:pypi:releaseCadenceCompressionRatio	component	number string	0.11	Derived from current gap ÷ baseline gap when enough history exists	Explainability signal for materially faster-than-usual releases	Context only
cdx:pypi:compressedCadence	component	boolean string	"true"	When the current release arrives materially faster than the established cadence baseline	Low-severity cadence anomaly signal for mature packages	Warning / triage
cdx:pylock:marker	component	string	python_version >= "3.11"	When parsed from PEP 751 pylock.toml package markers	Preserves lock-file install-condition context not modeled by CycloneDX	Warning / triage
cdx:pylock:dependencies	component	JSON string	[{"name":"attrs","version":"25.1.0"}]	When dependency selectors are recorded in pylock	Retains selector-level dependency metadata used for auditing	Context only
cdx:pylock:file:url	component(file)	URL string	https://files.pythonhosted.org/...whl	For pylock archive/sdist/wheel file entries	Captures artifact provenance details for reproducibility and verification	Warning / triage
cdx:pypi:versionSpecifiers	component	string	>=1.0,<2.0, ==2.31.0	When Python constraints are parsed	Important for pinning strictness and drift analysis	Warning / triage
cdx:pip:markers	component	string	python_version >= "3.11"	When marker-based conditional deps are present	Reveals conditional attack surface and environment sensitivity	Warning / triage
cdx:pip:structuredMarkers	component	JSON string	serialized marker AST	When structured markers are available	Better machine-readable alternative to raw marker strings	Warning / triage
cdx:python:requires_python	component/metadata	string	>=3.9	When root interpreter constraints are known	Lets policies detect unsupported or mismatched environments	Warning / triage
cdx:gem:remoteRevision	component	string	git commit SHA	When a gem is pinned to a git revision	Preferred immutable Ruby VCS source signal	Warning / triage
cdx:gem:remoteBranch	component	string	main	When a gem tracks a git branch	Mutable source indicator	Hard deny
cdx:gem:remoteTag	component	string	v1.2.3	When a gem tracks a git tag	Mutable source indicator unless combined with revision	Warning / triage
cdx:gem:yanked	component	boolean string	"true", "false"	When registry metadata shows the gem was yanked	Useful integrity and availability signal	Hard deny
cdx:cargo:features	component	JSON string	serialized feature map	When Cargo features are present	Indicates additional code paths and feature-based exposure	Warning / triage
cdx:cargo:git	component	URL string	https://github.com/org/crate	When Cargo dependency uses a git source	Mutable/non-registry provenance signal; combine with gitRev or gitTag to assess pinning	Hard deny
cdx:cargo:path	component	path string	../local-crate	When Cargo dependency uses a local path source	Strong non-hermetic local source signal	Hard deny
cdx:cargo:dependencyKind	component	enum string	runtime, build, dev	When Cargo manifest dependency sections are parsed	Distinguishes runtime from build/test-only surfaces	Warning / triage
cdx:cargo:target	component	target selector string	cfg(target_os = "linux")	When dependency is scoped to a Cargo target stanza	Helps separate platform-specific dependency exposure	Warning / triage
cdx:cargo:yanked	component	boolean string	"true"	When crates.io metadata shows the selected crate version was yanked	High-signal registry integrity and lifecycle warning	Hard deny
cdx:cargo:trustedPublishing	component	boolean string	"true"	When crates.io metadata exposes trusted publishing / provenance evidence	Positive provenance signal for Cargo releases	Warning / triage
cdx:cargo:hasNativeBuild	component/formulation	boolean string	"true"	When Cargo build.rs or native build helper crates are detected	Flags expanded execution surface in Rust build pipelines	Warning / triage
cdx:cargo:buildScriptCapabilities	formulation component	list string	process-execution, linker-directives	When Cargo build.rs content is available for heuristic inspection	Makes build-time execution, linker, file-generation, or network behavior visible to policy	Warning / triage
cdx:cargo:workspaceRoot	component	path string	/repo/Cargo.toml	When a Cargo package inherits metadata or dependencies from a workspace root	Helps explain version/license/source inheritance and workspace-scoped dependency resolution	Context only
cdx:cargo:workspaceDependency	component	boolean string	"true"	When a Cargo dependency entry is inherited via workspace = true	Distinguishes workspace-managed dependencies from standalone manifest entries	Context only
cdx:cargo:workspaceDependencyResolved	component	boolean string	"true"	When a workspace-managed Cargo dependency resolves to another workspace member	Helps distinguish build-only workspace helpers from runtime-facing member crates	Warning / triage
cdx:cargo:resolvedWorkspaceMember	component	string	core	When a workspace dependency resolves to a specific member crate	Useful for member-to-member graph review and workspace triage	Context only
cdx:cargo:resolvedMemberPath	component	path string	/repo/crates/core/Cargo.toml	When a workspace dependency resolves to a specific member manifest	Makes inherited/path-like workspace relationships explicit	Context only
cdx:cargo:cacheSource	component	enum string	registry-cache	When a component is cataloged from the Cargo cache project type	Differentiates cached crate inventory from source-manifest or lockfile-derived inventory	Context only
cdx:rust:buildTool	formulation component	enum string	cargo, maturin	When formulation parsing detects Rust build/release tooling	Lets audit rules pivot on Cargo vs maturin build paths	Context only
cdx:github:action:ecosystem	workflow component	enum string	cargo	When a GitHub Action is recognized as ecosystem-specific tooling such as Cargo setup/cache actions	Lets BOM audit and cdx-audit correlate exact ecosystem tooling actions with build surfaces	Context only
cdx:github:action:role	workflow component	list string	toolchain, cache, tool-install	When a GitHub Action is recognized as a toolchain/cache/install action	Useful for distinguishing setup steps from cache restores or installer helpers	Warning / triage
cdx:github:step:usesCargo	workflow component	boolean string	"true"	When a workflow run: step executes one or more Cargo commands	Lets rules correlate Cargo build/test/package/publish activity with native build surfaces	Warning / triage
cdx:github:step:cargoSubcommands	workflow component	list string	build, test	When a workflow run: step executes Cargo subcommands	Preserves the high-level Cargo operation mix seen in CI/CD	Warning / triage
cdx:github:step:cargoWorkspaceScope	workflow component	boolean string	"true"	When a workflow Cargo command operates across --workspace, --all, or --all-targets	Highlights workflow steps that exercise more of a workspace than a single crate	Warning / triage
cdx:go:local_dir	component	path string	../local-module	When Go replace points to a local path	Strong non-hermetic build signal	Hard deny
cdx:go:deprecated	component	string	deprecation message	When Go module metadata is deprecated	Good triage and lifecycle signal	Warning / triage
cdx:golem:securitySignalSeverity	component	enum string	high	When Golem maps a security-sensitive Go API signal back to a module	Prioritizes semantic source review beyond manifest presence	Hard deny
cdx:golem:securitySignalCategory	component	enum/list string	weak-crypto	Alongside Golem security signal severity	Explains what class of API usage or configuration triggered review	Warning / triage
cdx:golem:usageScopes	component	list string	runtime,test	When imports or symbol usages map to a Go module	Separates production usage from test, benchmark, fuzz, or example-only evidence	Warning / triage
cdx:golem:occurrenceEvidenceKinds	component	list string	import,symbolCall	When Golem can explain how a module was observed	Tells reviewers whether evidence came from import presence or symbol-level usage	Context only
cdx:golem:localReplacement	component	boolean string	"true"	When the analyzed Go module graph marks a dependency as locally replaced	Strong non-hermetic build and provenance bypass signal	Hard deny
cdx:golem:privateModuleCandidate	component	boolean string	"true"	When Golem identifies a module as likely private or internal	Requires internal provenance, access-control, and license-review evidence	Warning / triage
cdx:golem:vendored	component	boolean string	"true"	When a module appears in the vendor tree	Useful for redistribution and license-file completeness checks	Warning / triage
cdx:golem:licenseFileCount	component	number string	1	When Golem maps license files to a module	Supports vendored module compliance and release evidence review	Warning / triage
cdx:golem:callGraphMode	metadata.component	enum string	none, static, cha, rta, vta	On the root metadata component after Go Evinse runs Golem	Explains precision and performance trade-offs for the evidence run	Context only
cdx:golem:nativeArtifactCount	metadata.component	number string	3	When Golem sees C, C++, Objective-C, assembly, native objects, cgo, or related sidecars	Highlights cross-platform, build-performance, and native review surface	Warning / triage
cdx:collider:dependencyKind	component	enum string	direct, transitive	When parsing Collider lockfile entries from dependencies vs packages	Distinguishes root intent from lock-only transitive inventory	Context only
cdx:collider:origin	component	URL string	https://packages.example.com/collider/v2/	When Collider lockfile origin metadata is present (sanitized before emission)	Provenance signal for repository allowlists and mirror policy	Warning / triage
cdx:collider:originScheme	component	enum string	https, http, file	Derived from sanitized Collider origin URL	Useful for blocking insecure HTTP origins or isolating local/offline mirrors	Hard deny
cdx:collider:originHost	component	string	packages.example.com	When the sanitized Collider origin has a network host	Handy for host-level allowlists and explainability	Context only
cdx:collider:originSanitized	component	boolean string	"true"	When credentials, query strings, or fragments were stripped from Collider origin metadata	Signals potentially secret-bearing or unstable signed URLs in the original lockfile	Warning / triage
cdx:collider:hasWrapHash	component	boolean string	"true", "false"	When Collider lockfile wrap hash metadata is present and valid	Fast integrity gate for wrap-hash-pinned reproducibility	Hard deny
cdx:collider:wrapHash	component	string	sha256:abc123...	When Collider lockfile records the wrap file digest	Exact immutable wrap fingerprint for verification and incident correlation	Warning / triage
cdx:collider:wrapHashInvalid	component	boolean string	"true"	When Collider lockfile contains a malformed wrap hash	High-signal integrity issue indicating a stale, malformed, or tampered lock entry	Hard deny
cdx:dotnet:hint_path	component	path string	..\\..\\lib\\external.dll	When .NET assembly references use HintPath	Useful for local/GAC/side-loaded binary provenance	Warning / triage
cdx:maven:shaded	component	boolean string	"true", "false"	When shaded/relocated bytecode is detected	Can signal vendoring, obfuscation, or namespace relocation risk	Warning / triage
cdx:nix:revision	component	string	git commit SHA	When flake lock contains a revision	Important reproducibility anchor	Hard deny
cdx:nix:nar_hash	component	string	sha256-...	When flake lock contains content hash	Important integrity and reproducibility anchor	Hard deny
cdx:nix:input_url	component	URL string	github:nixos/nixpkgs/nixos-24.05	When flake input URLs are parsed	Provenance signal for source origin policy	Warning / triage
cdx:swift:localCheckoutPath	component	path string	checkouts/MyDep-1.0.0	When SwiftPM uses a local checkout	Detects local or developer-only dependency provenance	Hard deny
cdx:pods:projectDir	component	path string	/path/to/project	When CocoaPods uses a local project directory	Local provenance signal for pod sourcing	Warning / triage
cdx:pub:registry	component	URL string	https://pub.company.example	When Dart pub uses a non-default registry	Useful for registry allowlists	Hard deny
cdx:deno:source	component	string	jsr, npm, https	On every component parsed from a deno.lock, recording which Deno dependency channel it originated from	Distinguishes JSR, npm-registry, and remote https:// URL imports so registry/source allowlists can treat them differently	Hard deny
cdx:deno:jsrKey	component	string	@std/assert@1.0.19	On JSR components, whose purl is rewritten to the @jsr/<owner>__<name> npm-compat form	Preserves the original JSR identity for traceability and to pivot back from the npm-compat purl	Context only
cdx:deno:integrity	component	string	eaada96ee120... (raw sha256 hex)	On JSR components that carry a Deno-provided integrity hash	Records the source-verbatim JSR integrity digest as published in deno.lock for reproducibility and verification	Context only
cdx:scala:compilerVersion	component	string	3, 2.13	The Scala compiler target binary version extracted from the artifact name suffix	Supports downstream package matching and precise Scala version verification	Context only

High-value combinations

• cdx:npm:hasInstallScript=true + cdx:npm:isRegistryDependency=false
• cdx:npm:native_addon=true + platform constraints (cdx:npm:cpu, cdx:npm:os, cdx:npm:libc)
• cdx:npm:isLink=true + cdx:npm:resolvedPath present + cdx:npm:isWorkspace=false
• cdx:npm:nameMismatchError or cdx:npm:versionMismatchError present
• cdx:pypi:registry non-allowlisted + unpinned cdx:pypi:versionSpecifiers
• cdx:pip:markers present + incompatible cdx:python:requires_python
• cdx:gem:remote=git + cdx:gem:remoteBranch without cdx:gem:remoteRevision
• cdx:gem:yanked=true
• cdx:cargo:git present + missing cdx:cargo:gitRev and cdx:cargo:gitTag
• cdx:cargo:path present in release-oriented BOMs
• cdx:cargo:yanked=true
• cdx:rust:buildTool=cargo + cdx:cargo:hasNativeBuild=true
• cdx:cargo:workspaceDependencyResolved=true + cdx:cargo:dependencyKind=build
• cdx:rust:buildTool=cargo + cdx:cargo:hasNativeBuild=true + Cargo workflow setup action not SHA pinned
• cdx:rust:buildTool=cargo + cdx:cargo:buildScriptCapabilities includes process-execution or network-access + workflow runs cargo build, cargo test, cargo package, or cargo publish
• cdx:go:local_dir present + repository policy forbids local replacement
• cdx:golem:securitySignalSeverity=high + cdx:golem:usageScopes contains runtime
• cdx:golem:vendored=true + missing or zero cdx:golem:licenseFileCount
• cdx:golem:localReplacement=true + release or CI build context
• cdx:rusi:securitySignalSeverity=high + cdx:rusi:usageKind contains runtime usage
• cdx:rusi:cryptoFindingSeverity=high + cdx:rusi:dataFlowCategories contains sensitive data flows
• cdx:nix:ref present without cdx:nix:revision or cdx:nix:nar_hash
• cdx:swift:localCheckoutPath present + production release profile
• cdx:pods:projectDir present + remote podspec source mismatch
• cdx:collider:originScheme=http
• cdx:collider:originSanitized=true
• cdx:collider:hasWrapHash=false or cdx:collider:wrapHashInvalid=true

Golem Go Evinse evidence

cdx:golem:* properties are emitted by evinse -l go when the golem helper is available. They are intentionally split between the root metadata component, the analyzed Go application component, dependency components, and rendered cryptographic-asset components.

Use metadata-level values to judge the evidence run: tool version, call graph/data-flow modes, file/module counts, generated file counts, native artifact counts, security signal totals, build directive kinds, Go directive version, toolchain directive, workspace/vendor presence, and data-flow performance counters.

Use component-level values to judge dependency posture: module path, Go version, usage scopes, occurrence evidence kinds, direct import status, symbol usage kind, local replacement status, vendoring, private module hints, license-file evidence, security signal category/severity, data-flow categories, crypto-flow flags, and call-stack/occurrence coverage.

Use crypto-asset values to judge CBOM pivots: source symbol, usage scope, strength, source location, algorithm OID, protocol type/version, or related crypto material type. cdxgen intentionally does not assign purls to cryptographic-asset components.

These properties are safe for policy because they are small values, counts, categories, source locations, and module facts. They do not copy Go generator commands, environment values, HTTP parameter values, raw key material, plaintext, ciphertext, embedded file contents, generated file contents, or secrets into the BOM. Source file names and private module paths can still reveal internal structure, so review an enriched BOM before sharing it outside the organization.

The built-in BOM audit categories golem-security, golem-performance, and golem-compliance use these properties directly. In cdxi, use .golemsummary, .golemhotspots, and .golemcoverage to inspect the same evidence interactively.

Golem metadata-level inventory

Property	Meaning
cdx:golem:toolVersion	Golem helper version.
cdx:golem:callGraphMode	Main call graph mode (none, static, cha, rta, vta).
cdx:golem:dataFlowMode	Data-flow mode (none, security, crypto, all).
cdx:golem:dataFlowCallGraphMode	Call graph mode used for data-flow dynamic summary replay.
cdx:golem:noRecurse, cdx:golem:includeAllFlows	Effective recursive child-module discovery and module-cache-only flow filtering defaults.
cdx:golem:dataFlowPacks	Data-flow pattern packs used for the run.
cdx:golem:packageCount, cdx:golem:moduleCount, cdx:golem:fileCount	Project size counters.
cdx:golem:generatedFileCount, cdx:golem:generatorKinds	Generated source counters and safe generator categories.
cdx:golem:importCount, cdx:golem:declarationCount, cdx:golem:usageCount	Import, declaration, and typed usage counters.
cdx:golem:runtimeUsageCount, cdx:golem:testUsageCount, cdx:golem:benchmarkUsageCount, cdx:golem:fuzzUsageCount, cdx:golem:exampleUsageCount	Usage-scope counters.
cdx:golem:buildDirectiveCount, cdx:golem:buildDirectiveKinds, cdx:golem:goGenerateCount, cdx:golem:goEmbedCount	Build directive and safe directive-kind summaries.
cdx:golem:nativeArtifactCount, cdx:golem:nativeArtifactKinds	cgo, native source/object, assembly, and related sidecar summaries.
cdx:golem:securitySignalCount, cdx:golem:securitySignalCategories, cdx:golem:securitySignalSeverities	Security-sensitive API signal summaries.
cdx:golem:diagnosticCount	Golem diagnostic count.
cdx:golem:goDirectiveVersion, cdx:golem:toolchainDirective, cdx:golem:goWorkPresent	Go module/workspace toolchain facts.
cdx:golem:goModReplaceCount, cdx:golem:goModExcludeCount, cdx:golem:replaceModule, cdx:golem:replaceTargetPathKind, cdx:golem:localReplacementPresent, cdx:golem:excludeModule	Replace/exclude directive summaries.
cdx:golem:vendorDirectoryPresent, cdx:golem:vendorModuleCount, cdx:golem:workspaceModuleCount	Vendor and workspace summaries.
cdx:golem:privateModuleHintCount, cdx:golem:licenseFileModuleCount	Private-module and license-file evidence counters.
cdx:golem:callGraphNodeCount, cdx:golem:callGraphEdgeCount	Main call graph size counters.
cdx:golem:dataFlowSourceCount, cdx:golem:dataFlowSinkCount, cdx:golem:dataFlowSliceCount	Data-flow source/sink/slice counters.
cdx:golem:dataFlowNodeCount, cdx:golem:dataFlowEdgeCount, cdx:golem:dataFlowSummaryCount	Data-flow graph and summary counters.
cdx:golem:dataFlowCandidateFunctionCount, cdx:golem:dataFlowFunctionCount, cdx:golem:dataFlowSkippedFunctionCount, cdx:golem:dataFlowInstructionCount	SSA/function materialization counters.
cdx:golem:dataFlowWorkerCount, cdx:golem:dataFlowElapsedMillis	Performance counters for data-flow runs.
cdx:golem:dataFlowUniqueFlowCount, cdx:golem:dataFlowDuplicateSliceCount, cdx:golem:dataFlowDuplicateGroupCount, cdx:golem:dataFlowMaxPathLength	Data-flow deduplication and trace-size counters.
cdx:golem:dataFlowSanitizedSliceCount, cdx:golem:dataFlowTruncated, cdx:golem:dataFlowTruncationReasons	Sanitization and truncation summaries.
cdx:golem:cryptoLibraryCount, cdx:golem:cryptoAssetCount, cdx:golem:cryptoOperationCount, cdx:golem:cryptoMaterialCount, cdx:golem:cryptoProtocolCount, cdx:golem:cryptoFindingCount	Crypto evidence counters.
cdx:golem:cryptoAlgorithms, cdx:golem:cryptoMaterialTypes, cdx:golem:cryptoProtocols	Crypto evidence summaries.
cdx:golem:cryptoDataFlowCount	Total crypto-related data-flow slices attached to components.

Golem component-level inventory

Property	Meaning
cdx:golem:modulePath, cdx:golem:goVersion, cdx:golem:mainModule	Go module identity and toolchain facts.
cdx:golem:replacementModule, cdx:golem:localReplacement	Replacement target and local replacement signal.
cdx:golem:vendored, cdx:golem:privateModuleCandidate, cdx:golem:licenseFileCount, cdx:golem:licenseFiles	Vendor/private/license evidence.
cdx:golem:usageScopes, cdx:golem:usageScope, cdx:golem:testOnly	Runtime/test/benchmark/fuzz/example usage posture.
cdx:golem:<scope>UsageCount	Per-scope counters, where <scope> is runtime, test, benchmark, fuzz, or example.
cdx:golem:occurrenceEvidenceKinds	Source of occurrence evidence, such as import, symbolCall, symbolReference, or dataFlowSlice.
cdx:golem:<kind>OccurrenceCount	Per-kind occurrence counters, including importOccurrenceCount, symbolCallOccurrenceCount, symbolReferenceOccurrenceCount, and dataFlowSliceOccurrenceCount.
cdx:golem:importDirect, cdx:golem:importAliasKind	Import evidence details.
cdx:golem:symbolKind, cdx:golem:usageKind	Typed symbol usage details.
cdx:golem:securitySignalCategory, cdx:golem:securitySignalSeverity	Component-level security signal classification.
cdx:golem:dataFlowCategories, cdx:golem:dataFlowRuleId, cdx:golem:dataFlowSeverity, cdx:golem:dataFlowConfidence, cdx:golem:dataFlowTaintKinds, cdx:golem:dataFlowSliceCount	Component-level data-flow classification and count.
cdx:golem:cryptoDataFlow, cdx:golem:cryptoDataFlowCategories, cdx:golem:cryptoDataFlowRuleId, cdx:golem:cryptoDataFlowTaintKinds, cdx:golem:cryptoDataFlowCount	Crypto-specific data-flow classification and count.
cdx:golem:cryptoOperationType, cdx:golem:cryptoAlgorithm, cdx:golem:cryptoFinding, cdx:golem:cryptoFindingSeverity	Crypto operation and finding pivots attached to owning Go modules.

Golem crypto-asset inventory

Property	Meaning
cdx:golem:crypto:sourceLocation	Source file, line, and column where the crypto asset was detected.
cdx:golem:crypto:strength	Conservative strength classification from Golem.
cdx:golem:crypto:symbol	Safe symbol name associated with the crypto asset.
cdx:golem:crypto:usageScope	Usage scope associated with the crypto asset.

Rusi Rust Evinse evidence

cdx:rusi:* properties are emitted by evinse -l rust when the rusi helper is available. They are intentionally split between the root metadata component, the analyzed Rust application component, dependency components, and rendered cryptographic-asset components. Use metadata-level values to judge the evidence run: tool version, rustc/cargo versions, call graph/data-flow modes, package/file/import/usage counts, crypto library/finding counts, and data-flow graph sizes. Use component-level values to judge dependency posture: import paths/aliases, usage kinds, data-flow categories/rules/slice counts, security signal categories/severities, and crypto finding categories/severities. Use crypto-asset values to judge CBOM pivots: source symbol, provider, operation, function, confidence, and source location. cdxgen intentionally does not assign purls to cryptographic-asset components. These properties are safe for policy because they are small values, counts, categories, source locations, and module facts. They do not copy Rust generator commands, environment values, HTTP parameter values, raw key material, plaintext, ciphertext, embedded file contents, generated file contents, or secrets into the BOM. Source file names and private module paths can still reveal internal structure, so review an enriched BOM before sharing it outside the organization.

Rusi metadata-level inventory

Property	Meaning
cdx:rusi:schemaVersion	Rusi report schema version.
cdx:rusi:toolVersion	Rusi helper version.
cdx:rusi:rustcVersion, cdx:rusi:cargoVersion, cdx:rusi:host	Rust toolchain and host environment facts.
cdx:rusi:backend, cdx:rusi:analysisScope	Analysis configuration facts.
cdx:rusi:callGraphMode, cdx:rusi:dataFlowMode	Call graph and data-flow modes used.
cdx:rusi:packageCount, cdx:rusi:fileCount, cdx:rusi:importCount, cdx:rusi:declarationCount, cdx:rusi:usageCount	Project size and usage counters.
cdx:rusi:securitySignalCount	Security-sensitive API signal summary.
cdx:rusi:cryptoLibraryCount, cdx:rusi:cryptoComponentCount, cdx:rusi:cryptoFindingCount	Crypto evidence counters.
cdx:rusi:callGraphNodeCount, cdx:rusi:callGraphEdgeCount	Call graph size counters.
cdx:rusi:dataFlowNodeCount, cdx:rusi:dataFlowEdgeCount, cdx:rusi:dataFlowSliceCount	Data-flow graph and slice counters.

Rusi component-level inventory

Property	Meaning
cdx:rusi:importPath, cdx:rusi:importAlias	Import evidence details.
cdx:rusi:usageKind	Typed symbol usage details.
cdx:rusi:dataFlowCategories, cdx:rusi:dataFlowRuleName, cdx:rusi:dataFlowSliceCount	Component-level data-flow classification and count.
cdx:rusi:securitySignalCategory, cdx:rusi:securitySignalSeverity	Component-level security signal classification.
cdx:rusi:cryptoFindingCategory, cdx:rusi:cryptoFindingSeverity	Crypto finding pivots attached to owning Rust modules.

Rusi crypto-asset inventory

Property	Meaning
cdx:rusi:crypto:sourceLocation	Source file and line where the crypto asset was detected.
cdx:rusi:crypto:provider	Crypto provider or library name.
cdx:rusi:crypto:operation	Crypto operation type.
cdx:rusi:crypto:symbol	Safe symbol name associated with the crypto asset.
cdx:rusi:crypto:function	Function name for related crypto material.
cdx:rusi:crypto:confidence	Confidence level of the crypto material detection.

Example payload fragments

npm / pnpm execution risk

{
  "name": "example-pkg",
  "version": "1.0.0",
  "purl": "pkg:npm/example-pkg@1.0.0",
  "properties": [
    { "name": "cdx:npm:hasInstallScript", "value": "true" },
    { "name": "cdx:npm:risky_scripts", "value": "postinstall" },
    { "name": "cdx:npm:isRegistryDependency", "value": "false" },
    { "name": "cdx:npm:resolvedPath", "value": "file:../local-pkg" }
  ]
}

Nix reproducibility evidence

{
  "name": "nixpkgs",
  "purl": "pkg:nix/nixos/nixpkgs@24.05",
  "properties": [
    {
      "name": "cdx:nix:input_url",
      "value": "github:nixos/nixpkgs/nixos-24.05"
    },
    {
      "name": "cdx:nix:revision",
      "value": "1234567890abcdef1234567890abcdef12345678"
    },
    { "name": "cdx:nix:nar_hash", "value": "sha256-abc123..." },
    { "name": "cdx:nix:ref", "value": "nixos-24.05" }
  ]
}

Alias and overlap notes

• Prefer cdx:npm:isWorkspace, but match both cdx:npm:isWorkspace and cdx:npm:is_workspace in policies for compatibility.
• cdx:npm:bin/<command> keys are internal analyzer evidence labels, not emitted BOM component properties. They are produced when source/config analysis sees a package-manager wrapper invoke a command, such as npx license-report or pnpm dlx @angular/cli. During BOM construction, cdxgen matches those command labels against emitted package metadata such as cdx:npm:bin and cdx:npm:binPaths; when they match, the owning package is treated as used and can be marked scope: "required" without hardcoding a package-name allowlist.
• cdx:pip:structuredMarkers is the more machine-friendly companion to cdx:pip:markers; when both exist, parse the JSON string and prefer the structured form for policy logic, while keeping the raw form for explainability.
• cdx:gem:remoteBranch and cdx:gem:remoteTag are weaker, mutable source indicators than cdx:gem:remoteRevision.
• cdx:nix:ref is descriptive context; use cdx:nix:revision and cdx:nix:nar_hash as the stronger reproducibility gates.

AI / model artifact inventory

Authoritative grouped index

• AI model and service inventory: cdx:ai:artifactFormat, cdx:ai:confidence, cdx:ai:contextWindow, cdx:ai:deployment, cdx:ai:kind, cdx:ai:modelCount, cdx:ai:modelFamily, cdx:ai:modelId, cdx:ai:modelSelection, cdx:ai:modality, cdx:ai:parameterCount, cdx:ai:provider, cdx:ai:quantization, cdx:ai:reviewNeeded, cdx:ai:runtime, cdx:ai:source, cdx:ai:transportSecurity, cdx:ai:variant
• Hugging Face remote/runtime metadata: cdx:huggingface:downloads, cdx:huggingface:downloadsAllTime, cdx:huggingface:likes, cdx:huggingface:likesRecent, cdx:huggingface:gated, cdx:huggingface:private, cdx:huggingface:disabled, cdx:huggingface:fileCount, cdx:huggingface:libraryName, cdx:huggingface:spaceCount, cdx:huggingface:inferenceProvider, cdx:huggingface:inferenceProviderCount, cdx:huggingface:inferenceStatus, cdx:huggingface:inferenceTask, cdx:huggingface:previewable, cdx:huggingface:viewer, cdx:huggingface:papersWithCodeId, cdx:huggingface:taskCategory, cdx:huggingface:taskId, cdx:huggingface:sdk, cdx:huggingface:subdomain, cdx:huggingface:runtimeStage, cdx:huggingface:sdkVersion, cdx:huggingface:runtimeHardwareCurrent, cdx:huggingface:runtimeHardwareRequested, cdx:huggingface:modelCount, cdx:huggingface:datasetCount
• GGUF artifact metadata: cdx:gguf:alignment, cdx:gguf:basename, cdx:gguf:bosTokenId, cdx:gguf:chatTemplateDetected, cdx:gguf:chatTemplateLength, cdx:gguf:datasetCount, cdx:gguf:eosTokenId, cdx:gguf:finetune, cdx:gguf:formatVersion, cdx:gguf:huggingFaceTokenizer, cdx:gguf:language, cdx:gguf:metadataCount, cdx:gguf:paddingTokenId, cdx:gguf:quantizationVersion, cdx:gguf:quantizedBy, cdx:gguf:separatorTokenId, cdx:gguf:shard, cdx:gguf:shardCount, cdx:gguf:shardIndex, cdx:gguf:sidecar, cdx:gguf:sizeLabel, cdx:gguf:tensorCount, cdx:gguf:tokenizerAddedTokenCount, cdx:gguf:tokenizerMergeCount, cdx:gguf:tokenizerModel, cdx:gguf:tokenizerScoreCount, cdx:gguf:tokenizerTokenCount, cdx:gguf:tokenizerTokenTypeCount, cdx:gguf:type, cdx:gguf:unknownTokenId

Compact operational reference

Key	Scope	Value type	Typical values	When emitted	Why it matters	Policy readiness
cdx:ai:artifactFormat	model component	enum string	gguf, modelfile	When AI inventory finds a local model artifact or config	Separates direct local artifacts from source-only model references	Warning / triage
cdx:ai:quantization	model component	enum string	Q5_K_M, Q4_K_M, BF16, F16	When GGUF metadata or artifact naming reveals the weight encoding	Useful for capacity planning, local-runtime fit, and AI-BOM performance rules	Warning / triage
cdx:ai:contextWindow	model component	number string	8192, 32768	When a model artifact or config declares an explicit context length	High-signal governance and performance pivot for overly large local models	Warning / triage
cdx:ai:deployment	service	enum string	remote, local, implicit	When cdxgen observes inference endpoints or local runtimes	Separates SaaS-hosted inference from local-only deployments	Warning / triage
cdx:ai:transportSecurity	service	enum string	https, insecure-http, local-only	When service endpoints are present	Useful for blocking insecure remote AI integrations	Hard deny
cdx:ai:reviewNeeded	model component/service	boolean string	"true"	When local-only inference, Ollama discovery, or other human-review cues are present	One-bit reviewer hint that an AI finding deserves manual inspection	Warning / triage
cdx:huggingface:downloadsAllTime	remote model/dataset	number string	67890, 12337416	When remote Hugging Face resolution is enabled and the API returns long-run download totals	Helpful governance signal for distinguishing niche/internal experiments from widely consumed hub artifacts	Warning / triage
cdx:huggingface:inferenceProvider, cdx:huggingface:inferenceStatus, cdx:huggingface:inferenceTask	remote model	repeated string	hf-inference, live, text-generation	When the Hub advertises hosted inference backends for the model	Highlights hosted-inference exposure and clarifies whether the same repo is intended for local-only or managed serving	Warning / triage
cdx:huggingface:sdk, cdx:huggingface:runtimeStage, cdx:huggingface:sdkVersion	remote space	enum/string	gradio, RUNNING, 5.0.0	When a Hugging Face Space is resolved remotely	Makes Space runtime posture and deployment health visible to AI-BOM review	Warning / triage
cdx:huggingface:modelCount, cdx:huggingface:datasetCount	remote space	number string	1, 2	When a Space declares linked models or datasets	Useful for spotting multi-asset Spaces that should also receive dependency or governance review	Warning / triage
cdx:huggingface:gatedFieldCount, cdx:huggingface:gatedPromptCustomized	modelCard properties	number/boolean	1, "true"	When a model card customizes gated-access prompts or requested fields	Signals that access is workflow- or compliance-mediated without copying the raw access form into the BOM	Warning / triage
cdx:gguf:sizeLabel	model + file component	string	7B, 8x7B, 3.8B-ContextLength4k	When GGUF metadata or naming convention carries the size class	Preserves model-class evidence that is often visible in filenames but not otherwise machine-ready	Context only
cdx:gguf:sidecar	model + file component	enum string	mmproj, mtp	When a GGUF filename follows the sidecar naming convention	Distinguishes auxiliary projector / draft-model artifacts from standalone model weights	Warning / triage
cdx:gguf:type	model + file component	enum string	LoRA, vocab	When the GGUF naming convention declares a non-default artifact kind	Helps reviewers separate adapters and vocab-only files from normal tensor artifacts	Warning / triage
cdx:gguf:shard	file component	string	00001-of-00002	When a GGUF artifact filename includes shard coordinates	Makes multi-file model layouts explicit and easier to verify during packaging and deployment	Context only
cdx:gguf:shardIndex	file component	number string	1, 2	When the shard marker is present	Lets policies reason about shard completeness without parsing the combined string	Context only
cdx:gguf:shardCount	file component	number string	2, 9	When the shard marker is present	Useful for completeness checks on distributed/sharded local model assets	Context only
cdx:gguf:alignment	file component	number string	32, 64	When general.alignment is present in GGUF metadata	Captures artifact-level GGUF layout details relevant to loader compatibility	Context only
cdx:gguf:formatVersion	file component	number string	3	For parsed GGUF artifacts	Preserves the on-disk GGUF format version independently from the model's own version	Context only
cdx:gguf:quantizationVersion	model + file component	number string	2, 4	When GGUF metadata declares quantization-format versioning	Complements cdx:ai:quantization with the low-level GGUF quantization revision	Context only
cdx:gguf:tensorCount	file component	number string	291, 842	For parsed GGUF artifacts	Useful artifact-shape evidence for forensic comparison and packaging sanity checks	Context only
cdx:gguf:tokenizerModel	model + file component	enum string	llama, gpt2, rwkv	When GGUF metadata declares the embedded tokenizer family	Helps reviewers understand tokenizer/runtime compatibility assumptions	Warning / triage
cdx:gguf:tokenizerTokenCount	model + file component	number string	32000, 128256	When GGUF metadata includes tokenizer.ggml.tokens	Useful tokenizer-shape evidence without embedding the raw vocabulary	Context only
cdx:gguf:tokenizerScoreCount	model + file component	number string	32000	When GGUF metadata includes tokenizer score arrays	Sanity-checks tokenizer completeness without copying score payloads	Context only
cdx:gguf:tokenizerTokenTypeCount	model + file component	number string	32000	When GGUF metadata includes tokenizer token-type arrays	Highlights partial tokenizer exports or executor-compatibility mismatches	Context only
cdx:gguf:tokenizerMergeCount	model + file component	number string	50000	When GGUF metadata includes BPE merge rules	Preserves tokenizer-shape evidence without exposing the merge list	Context only
cdx:gguf:tokenizerAddedTokenCount	model + file component	number string	1, 12	When GGUF metadata includes added tokens	Highlights tool/chat/vendor tokenizer extensions	Warning / triage
cdx:gguf:huggingFaceTokenizer	model + file component	boolean string	"true"	When GGUF metadata embeds a Hugging Face tokenizer JSON	Distinguishes GGML-only tokenization from artifacts carrying a higher-fidelity HF tokenizer	Warning / triage
cdx:gguf:chatTemplateDetected	model + file component	boolean string	"true"	When GGUF metadata embeds tokenizer.chat_template	High-signal hint that the model expects chat-style prompt framing	Warning / triage
cdx:gguf:chatTemplateLength	model + file component	number string	128, 512	When a GGUF chat template is present	Preserves a safe derivative of the prompt contract without copying the raw template	Context only
cdx:gguf:bosTokenId, cdx:gguf:eosTokenId, cdx:gguf:unknownTokenId, cdx:gguf:separatorTokenId, cdx:gguf:paddingTokenId	model + file component	number string	0, 1, 2	When GGUF metadata declares tokenizer special-token IDs	Useful tokenizer compatibility pivots for runtimes and prompt-packaging workflows	Context only
cdx:gguf:language	model + file component	repeated string	en, fr, ja	When GGUF metadata declares supported languages	Preserves multilingual capability hints without overloading standard CycloneDX fields	Context only
cdx:gguf:datasetCount	model + file component	number string	1, 3	When GGUF metadata includes general.datasets	Quick governance signal that training/evaluation datasets were declared in the artifact metadata	Context only

High-value combinations

• cdx:ai:artifactFormat=gguf + cdx:ai:deployment=local
• cdx:ai:contextWindow above internal review thresholds + cdx:ai:reviewNeeded=true
• cdx:huggingface:gated=true + cdx:huggingface:gatedFieldCount present
• cdx:huggingface:runtimeStage=RUNNING + cdx:huggingface:modelCount>0 on a Space component
• cdx:huggingface:downloadsAllTime high + cdx:ai:quantization missing on a large local derivative
• cdx:gguf:chatTemplateDetected=true + cdx:gguf:tokenizerAddedTokenCount>0
• cdx:gguf:huggingFaceTokenizer=true + cdx:gguf:tokenizerModel=llama
• cdx:gguf:sidecar=mmproj + missing corresponding base-model dependency or deployment documentation
• cdx:gguf:type=LoRA + missing pedigree.ancestors[] on the corresponding model component
• cdx:gguf:shardCount present + fewer observed GGUF file components than expected

Cross-cutting BOM/service/build metadata

Authoritative grouped index

• cdx:bom:componentNamespaces
• cdx:bom:componentSrcFiles
• cdx:bom:componentTypes
• cdx:build:versionSpecifiers
• cdx:lolbas:attackTactics
• cdx:lolbas:attackTechniques
• cdx:lolbas:contexts
• cdx:lolbas:functions
• cdx:lolbas:matchFields
• cdx:lolbas:matched
• cdx:lolbas:names
• cdx:lolbas:queryCategory
• cdx:lolbas:references
• cdx:lolbas:riskTags
• cdx:lolbas:sourceRef
• cdx:container:attackTactics
• cdx:container:attackTechniques
• cdx:container:knowledgeSourceRefs
• cdx:container:knowledgeSources
• cdx:container:matchSource
• cdx:container:matched
• cdx:container:name
• cdx:container:offenseTools
• cdx:container:riskTags
• cdx:container:seccompBlockedSyscalls
• cdx:container:seccompProfile
• cdx:gtfobins:contexts
• cdx:gtfobins:functions
• cdx:gtfobins:matchSource
• cdx:gtfobins:matched
• cdx:gtfobins:mitreTechniques
• cdx:gtfobins:name
• cdx:gtfobins:privilegedContexts
• cdx:gtfobins:reference
• cdx:gtfobins:riskTags
• cdx:gtfobins:sourceRef
• cdx:osquery:category
• cdx:service:httpMethod
• cdx:dosai:crypto:id
• cdx:dosai:crypto:strength
• cdx:dosai:crypto:storage
• cdx:dosai:crypto:reachableFromEntryPoint
• cdx:dosai:crypto:entryPointCount
• cdx:dosai:crypto:dataFlowSliceIds

Compact operational reference

Key	Scope	Value type	Typical values	When emitted	Why it matters	Policy readiness
cdx:bom:componentNamespaces	metadata	list string	pkg:npm, pkg:pypi, pkg:maven	After BOM post-processing	Shows ecosystem breadth and helps explain mixed-language outputs	Context only
cdx:bom:componentSrcFiles	metadata	list string	package.json, requirements.txt, pom.xml	After BOM post-processing	Useful for completeness gates and evidence-of-origin attestations	Warning / triage
cdx:bom:componentTypes	metadata	list string	library, application, container	After BOM post-processing	Helps identify unexpectedly narrow or broad BOM composition	Warning / triage
cdx:build:versionSpecifiers	component	string	>=1.0,<2.0	When build metadata yields non-exact constraints	Good pinning strictness signal for build ecosystems	Warning / triage
cdx:lolbas:names	component	list string	powershell.exe,regsvr32.exe	When Windows osquery rows reference curated LOLBAS helpers	Useful pivot for startup persistence, WMI, or process triage	Warning / triage
cdx:lolbas:attackTechniques	component	list string	T1059.001,T1218.010	When LOLBAS helpers map to ATT&CK techniques	Aligns Windows host telemetry with ATT&CK-aware policy pipelines	Warning / triage
cdx:lolbas:riskTags	component	list string	proxy-execution,network-transfer,uac-bypass	When LOLBAS helpers imply higher-level abuse categories	Helps prioritize Windows persistence or proxy-execution review	Warning / triage
cdx:container:attackTechniques	component	list string	T1611,T1613,T1552.007	When executables match curated container tradecraft knowledge	Maps binaries to ATT&CK for Containers or related ATT&CK techniques	Warning / triage
cdx:container:offenseTools	component	list string	peirates,cdk,deepce	When executables overlap known container intrusion playbooks	High-signal context for cluster-pivot or offensive toolkit review	Warning / triage
cdx:container:seccompBlockedSyscalls	component	list string	setns,unshare,open_by_handle_at	When helper abuse depends on syscalls blocked by Docker seccomp	Helps prevent breakouts caused by permissive or disabled seccomp	Warning / triage
cdx:gtfobins:functions	component	list string	shell,upload,file-read	When collected container executables match GTFOBins-derived data	Encodes post-exploit primitives available inside the image	Warning / triage
cdx:gtfobins:privilegedContexts	component	list string	sudo,suid,capabilities	When GTFOBins metadata exposes privileged execution contexts	High-value hardening signal for breakout and privilege review	Hard deny
cdx:gtfobins:riskTags	component	list string	container-escape,privilege-escalation	When GTFOBins functions imply higher-level container risk tags	Good summary field for audit rules and triage	Warning / triage
cdx:osquery:category	component	string	packages, system	When packages are discovered through osquery	Indicates evidence source and confidence context	Context only
cdx:service:httpMethod	service	string	GET, POST, DELETE	When OpenAPI/service endpoints are captured	Useful for API exposure reviews and method-specific policy	Context only
cdx:dosai:crypto:id	component	string	asset-uuid, op-uuid	When dosai reports an asset/operation/material with an ID	Stable identity pivot for deduplication and cross-reference	Context only
cdx:dosai:crypto:strength	component	string	128, 256	When dosai reports an asset/operation with key strength info	Identifies weak cryptographic key sizes for algorithm review	Warning / triage
cdx:dosai:crypto:storage	component	string	hardcoded, environment, config	When dosai detects a material with a known storage type	Flags hardcoded crypto material as high-risk supply-chain exposure	Hard deny
cdx:dosai:crypto:reachableFromEntryPoint	component	boolean string	"true", "false"	For every dosai asset/operation/material	Separates actively reachable crypto from dead code	Warning / triage
cdx:dosai:crypto:entryPointCount	component	number string	1, 5	When dosai reports one or more entry-point IDs	Higher counts indicate broader reachability surface	Warning / triage
cdx:dosai:crypto:dataFlowSliceIds	component	list string	dfs1,dfs2	When dosai reports data-flow slice IDs for an asset or material	Enables correlation with dosai data-flow slice output for triage	Context only

High-value combinations

• cdx:bom:componentTypes present + cdx:bom:componentSrcFiles present before allowing downstream signing
• Missing cdx:bom:componentSrcFiles for a BOM that otherwise claims broad language coverage
• cdx:build:versionSpecifiers present + policy requires exact pinning in build metadata
• cdx:lolbas:names present + cdx:osquery:category in windows_run_keys, scheduled_tasks, services_snapshot, or WMI tables
• cdx:lolbas:attackTechniques contains T1218 or T1548.002 on Windows persistence surfaces
• cdx:gtfobins:riskTags=container-escape + cdx:gtfobins:privilegedContexts present in runtime container images
• cdx:container:offenseTools present + cdx:container:riskTags=offensive-toolkit in any runtime image
• cdx:container:seccompBlockedSyscalls present + container deployed with unconfined or custom seccomp profiles
• cdx:service:httpMethod=DELETE or PATCH + public service exposure policy outside this document

Example payload fragment

{
  "metadata": {
    "properties": [
      {
        "name": "cdx:bom:componentNamespaces",
        "value": "pkg:npm\npkg:pypi\npkg:maven"
      },
      { "name": "cdx:bom:componentTypes", "value": "library\napplication" },
      {
        "name": "cdx:bom:componentSrcFiles",
        "value": "package.json\nrequirements.txt\npom.xml"
      }
    ]
  }
}

IDE and editor extensions

Authoritative grouped index

• VS Code extensions: cdx:vscode-extension:activationEvents, cdx:vscode-extension:browser, cdx:vscode-extension:contributes, cdx:vscode-extension:executesCode, cdx:vscode-extension:extensionDependencies, cdx:vscode-extension:extensionKind, cdx:vscode-extension:extensionPack, cdx:vscode-extension:ide, cdx:vscode-extension:lifecycleScripts, cdx:vscode-extension:main, cdx:vscode-extension:untrustedWorkspaces, cdx:vscode-extension:virtualWorkspaces, cdx:vscode-extension:vscodeEngine
• Chromium browser extensions: cdx:chrome-extension:browser, cdx:chrome-extension:channel, cdx:chrome-extension:profile, cdx:chrome-extension:profilePath, cdx:chrome-extension:manifestVersion, cdx:chrome-extension:updateUrl, cdx:chrome-extension:minimumChromeVersion, cdx:chrome-extension:versionName, cdx:chrome-extension:incognito, cdx:chrome-extension:offlineEnabled, cdx:chrome-extension:permissions, cdx:chrome-extension:optionalPermissions, cdx:chrome-extension:hostPermissions, cdx:chrome-extension:optionalHostPermissions, cdx:chrome-extension:commands, cdx:chrome-extension:contentScriptsRunAt, cdx:chrome-extension:contentScriptsMatches, cdx:chrome-extension:contentSecurityPolicy, cdx:chrome-extension:storageManagedSchema, cdx:chrome-extension:webAccessibleResourceMatches, cdx:chrome-extension:externallyConnectableMatches, cdx:chrome-extension:capabilities, cdx:chrome-extension:capability:fileAccess, cdx:chrome-extension:capability:deviceAccess, cdx:chrome-extension:capability:network, cdx:chrome-extension:capability:bluetooth, cdx:chrome-extension:capability:accessibility, cdx:chrome-extension:capability:codeInjection, cdx:chrome-extension:capability:fingerprinting, cdx:chrome-extension:hasAutofill, cdx:chrome-extension:edge:minimumVersion, cdx:chrome-extension:edge:urlOverrides, cdx:chrome-extension:brave:maybeBackground, cdx:chrome-extension:brave:permissions
• Electron ASAR archives: cdx:asar:entryCount, cdx:asar:fileCount, cdx:asar:directoryCount, cdx:asar:symlinkCount, cdx:asar:jsFileCount, cdx:asar:packageJsonCount, cdx:asar:lockfileCount, cdx:asar:hasUnpackedEntries, cdx:asar:unpackedFileCount, cdx:asar:hasNativeAddons, cdx:asar:nativeAddonCount, cdx:asar:hasIntegrityMismatch, cdx:asar:integrityMismatchCount, cdx:asar:hasSigningMetadata, cdx:asar:headerHash, cdx:asar:signingAlgorithm, cdx:asar:signingDeclaredHash, cdx:asar:signingSource, cdx:asar:signingScope, cdx:asar:signingVerified, cdx:asar:signingArchivePath, cdx:asar:capabilities, cdx:asar:capability:fileAccess, cdx:asar:capability:network, cdx:asar:capability:hardware, cdx:asar:capability:dynamicFetch, cdx:asar:capability:dynamicImport, cdx:asar:capability:codeGeneration, cdx:asar:capability:childProcess, cdx:asar:executionIndicators, cdx:asar:networkIndicators, cdx:asar:obfuscationIndicators, cdx:asar:path, cdx:asar:size, cdx:asar:offset, cdx:asar:unpacked, cdx:asar:executable, cdx:asar:linkTarget, cdx:asar:declaredIntegrityHash, cdx:asar:integrityVerified, cdx:asar:integrityBlockSize, cdx:asar:integrityBlockCount, cdx:asar:js:capabilities, cdx:asar:js:capability:fileAccess, cdx:asar:js:capability:network, cdx:asar:js:capability:hardware, cdx:asar:js:capability:dynamicFetch, cdx:asar:js:capability:dynamicImport, cdx:asar:js:capability:codeGeneration, cdx:asar:js:capability:childProcess, cdx:asar:js:hasEval, cdx:asar:js:hasDynamicFetch, cdx:asar:js:hasDynamicImport, cdx:asar:js:fileAccessIndicators, cdx:asar:js:networkIndicators, cdx:asar:js:hardwareIndicators, cdx:asar:js:executionIndicators, cdx:asar:js:obfuscationIndicators, cdx:asar:primaryManifest, cdx:asar:main, cdx:asar:module, cdx:asar:browser, cdx:asar:productName, cdx:asar:lifecycleScripts

Decision-oriented sub-groups

• Execution surface: cdx:vscode-extension:lifecycleScripts, cdx:vscode-extension:main, cdx:vscode-extension:browser, cdx:vscode-extension:contributes, cdx:vscode-extension:executesCode
• Privilege / trust: cdx:vscode-extension:untrustedWorkspaces, cdx:vscode-extension:virtualWorkspaces, cdx:vscode-extension:activationEvents
• Dependency chain: cdx:vscode-extension:extensionDependencies, cdx:vscode-extension:extensionPack
• Context / provenance: cdx:vscode-extension:ide, cdx:vscode-extension:extensionKind, cdx:vscode-extension:vscodeEngine
• Browser extension execution surface: cdx:chrome-extension:contentScriptsRunAt, cdx:chrome-extension:contentScriptsMatches, cdx:chrome-extension:commands, cdx:chrome-extension:contentSecurityPolicy, cdx:chrome-extension:capability:codeInjection, cdx:chrome-extension:hasAutofill
• Browser extension privilege / scope: cdx:chrome-extension:permissions, cdx:chrome-extension:optionalPermissions, cdx:chrome-extension:hostPermissions, cdx:chrome-extension:optionalHostPermissions
• Browser extension context / provenance: cdx:chrome-extension:browser, cdx:chrome-extension:channel, cdx:chrome-extension:profile, cdx:chrome-extension:profilePath, cdx:chrome-extension:manifestVersion, cdx:chrome-extension:updateUrl, cdx:chrome-extension:minimumChromeVersion, cdx:chrome-extension:versionName, cdx:chrome-extension:storageManagedSchema, cdx:chrome-extension:edge:minimumVersion, cdx:chrome-extension:brave:maybeBackground
• ASAR execution surface: cdx:asar:capabilities, cdx:asar:executionIndicators, cdx:asar:networkIndicators, cdx:asar:obfuscationIndicators, cdx:asar:js:capabilities, cdx:asar:js:executionIndicators, cdx:asar:js:networkIndicators, cdx:asar:js:hardwareIndicators
• ASAR integrity / provenance: cdx:asar:declaredIntegrityHash, cdx:asar:integrityVerified, cdx:asar:integrityBlockSize, cdx:asar:integrityBlockCount, cdx:asar:hasSigningMetadata, cdx:asar:headerHash, cdx:asar:signingAlgorithm, cdx:asar:signingDeclaredHash, cdx:asar:signingSource, cdx:asar:signingScope, cdx:asar:signingVerified, cdx:asar:signingArchivePath, cdx:asar:primaryManifest
• ASAR packaging posture: cdx:asar:hasUnpackedEntries, cdx:asar:unpackedFileCount, cdx:asar:hasNativeAddons, cdx:asar:nativeAddonCount, cdx:asar:lifecycleScripts

Compact operational reference

Key	Scope	Value type	Typical values	When emitted	Why it matters	Policy readiness
cdx:asar:hasIntegrityMismatch	component	string	true, false	When a declared ASAR integrity hash does not match file contents	High-signal tamper or packaging-defect indicator for shipped desktop artifacts	Hard deny
cdx:asar:hasSigningMetadata	component	string	true, false	When Electron Info.plist exposes ElectronAsarIntegrity data	Quick pivot showing the release artifact carries explicit signing metadata	Context only
cdx:asar:hasNativeAddons	component	string	true, false	When .node binaries are shipped in the archive or .unpacked	Native addons increase review depth, sandbox escape interest, and platform-specific attack surface	Warning / triage
cdx:asar:hasUnpackedEntries	component	string	true, false	When ASAR metadata marks entries as unpacked	Unpacked files are writable/extractable on disk and often include native code or helper executables	Warning / triage
cdx:asar:headerHash	component	string	sha256 hex digest	When cdxgen computes the ASAR header hash	Lets reviewers compare computed header bytes with Electron-declared signing metadata	Context only
cdx:asar:signingAlgorithm	component	string	SHA256	When Electron signing metadata is present	Identifies which digest algorithm the desktop packaging metadata expects	Context only
cdx:asar:signingDeclaredHash	component	string	ab12...	When Electron signing metadata is present	Carries the declared Electron header hash used for verification	Context only
cdx:asar:signingSource	component	string	Info.plist	When Electron signing metadata is present	Shows where signing metadata was sourced from during review	Context only
cdx:asar:signingScope	component	string	header-only	When Electron signing metadata is present	Prevents reviewers from mistaking Electron header verification for full payload signing	Warning / triage
cdx:asar:signingVerified	component	string	true, false	When Electron signing metadata is present	High-value signal that the declared Electron ASAR header hash matched or failed verification	Hard deny
cdx:asar:signingArchivePath	component	path string	Resources/app.asar	On emitted signing/crypto components	Binds a crypto asset back to the signed ASAR path inside the Electron app bundle	Context only
cdx:asar:capabilities	component	list string (comma-separated)	fileAccess, network, dynamicFetch, codeGeneration	When archive-level JS analysis rolls up per-file capability hits	Quick summary of packaged runtime posture without opening every archived file	Warning / triage
cdx:asar:js:capabilities	component	list string (comma-separated)	network, hardware, fileAccess, childProcess	On ASAR file components for JS/TS-like entries	Pinpoints which exact archived source files combine local access, network reach, or dynamic execution	Warning / triage
cdx:asar:js:hasEval	component	string	true, false	On archived JS file components	eval and related code generation patterns deserve manual review in packaged Electron applications	Hard deny
cdx:asar:js:hasDynamicFetch	component	string	true, false	On archived JS file components	Flags network calls where the URL is not statically known, complicating review and endpoint allowlisting	Warning / triage
cdx:asar:path	component	path string	src/main.js, node_modules/sketchy-addon/package.json	On ASAR file components	Stable archive-relative location useful for triage, provenance mapping, and attachment to release pipelines	Context only

High-value combinations

• cdx:asar:hasNativeAddons=true + cdx:asar:hasUnpackedEntries=true — archive ships native code outside the packed byte stream
• cdx:asar:hasIntegrityMismatch=true + cdx:asar:declaredIntegrityHash present — declared packaging metadata disagrees with computed content
• cdx:asar:hasSigningMetadata=true + cdx:asar:signingVerified=false — Electron signing metadata exists but the declared ASAR header hash failed verification
• cdx:asar:js:hasEval=true + cdx:asar:js:hasDynamicFetch=true — archived JavaScript can both generate code and fetch runtime-selected content
• cdx:asar:js:capabilities contains network + hardware — packaged source can reach external hosts and local devices

Compact operational reference

Key	Scope	Value type	Typical values	When emitted	Why it matters	Policy readiness
cdx:vscode-extension:activationEvents	component	list string (comma-separated)	onLanguage:python, onCommand:ext.run, *	When extension declares activation events in package.json	Wildcard * means the extension activates on every workspace open, increasing attack surface. Use $contains($split(value, ','), '*') in JSONata to detect always-on extensions.	Warning / triage
cdx:vscode-extension:extensionKind	component	list string	ui, workspace, ui, workspace	When extension declares where it can run	workspace extensions execute in the remote host context and can access the filesystem	Context only
cdx:vscode-extension:extensionDependencies	component	list string	ms-python.vscode-pylance, ms-toolsai.jupyter	When extension declares dependencies on other extensions	Transitive trust chain; a compromised dependency extension can affect all dependants	Warning / triage
cdx:vscode-extension:extensionPack	component	list string	ms-python.python, ms-python.vscode-pylance	When extension bundles other extensions as a pack	Pack extensions install additional extensions implicitly	Warning / triage
cdx:vscode-extension:untrustedWorkspaces	component	string	true, false, limited	When extension declares workspace trust configuration	true means the extension runs in untrusted workspaces; limited restricts some features	Warning / triage
cdx:vscode-extension:virtualWorkspaces	component	string	true, false	When extension declares virtual workspace support	Extensions supporting virtual workspaces may operate without direct filesystem access	Context only
cdx:vscode-extension:contributes	component	list string (comma-separated)	commands:count:42, terminal-access, filesystem-provider, authentication-provider	When extension package.json declares contributed features	Summary of privileged capabilities; use :count: suffix to identify quantity of contribution points (e.g., commands:count:12 means 12 commands contributed). Match specific capability keywords (terminal-access, filesystem-provider, etc.) for policy rules.	Warning / triage
cdx:vscode-extension:main	component	path string	./dist/extension.js, ./out/main.js	When extension declares a Node.js entry point	Identifies the primary executable entry point for security review	Context only
cdx:vscode-extension:browser	component	path string	./dist/web/extension.js	When extension declares a browser/web entry point in package.json	Indicates the extension can run in web/VS Code for Web contexts. Browser extensions run in a sandboxed environment with reduced permissions compared to Node.js (main) entry points. Use to differentiate web-safe vs. host-executing extensions.	Context only
cdx:vscode-extension:lifecycleScripts	component	list string	postinstall, vscode:prepublish, vscode:uninstall	When extension package.json contains lifecycle hooks	Install-time script execution risk; postinstall can run arbitrary code during extension installation	Hard deny
cdx:vscode-extension:executesCode	component	string	true, false	When vsixmanifest Properties declares ExecutesCode	Explicitly declares whether the extension executes code; true confirms the extension runs arbitrary code	Warning / triage
cdx:vscode-extension:vscodeEngine	component	semver range string	^1.94.0, >=1.80.0	When vsixmanifest Properties declares the required VS Code engine	Minimum VS Code version required; older engines may lack security features like workspace trust	Context only
cdx:vscode-extension:ide	component	string	vscode, cursor, vscodium, windsurf	When extension is discovered from a specific IDE's extension directory	Indicates which IDE the extension was found in; useful for fleet-wide inventory	Context only

High-value combinations

• cdx:vscode-extension:lifecycleScripts present + cdx:vscode-extension:activationEvents contains * — always-on extension with install-time execution
• cdx:vscode-extension:untrustedWorkspaces=true + cdx:vscode-extension:contributes contains filesystem-provider — extension operates in untrusted contexts with filesystem access
• cdx:vscode-extension:extensionKind contains workspace + cdx:vscode-extension:executesCode=true — extension executes arbitrary code on remote hosts
• cdx:vscode-extension:extensionPack present + any member has lifecycleScripts — pack implicitly installs extensions with install-time risks
• cdx:vscode-extension:browser present + cdx:vscode-extension:contributes contains terminal-access — potential cross-context capability confusion

Value normalization note for workspace trust properties:
The cdx:vscode-extension:untrustedWorkspaces and cdx:vscode-extension:virtualWorkspaces properties may originate from either a boolean or an object with a supported field in package.json. cdxgen normalizes these to string values:

• "true" → extension explicitly supports untrusted/virtual workspaces
• "false" → extension does not support untrusted/virtual workspaces
• "limited" → extension supports untrusted workspaces with reduced functionality (only for untrustedWorkspaces)

Policy authors should compare against these string values, not booleans.

JSONata tip for VS Code extension rules:
List-valued properties like cdx:vscode-extension:activationEvents, contributes, and extensionKind are comma-separated strings. Use the following pattern to match individual values:

$nullSafeProp($, 'cdx:vscode-extension:activationEvents') ~> $contains('*')

The $trim() step removes whitespace around comma-separated values for reliable matching.

Example payload fragment

{
  "name": "python",
  "publisher": "ms-python",
  "version": "2024.8.1",
  "type": "application",
  "purl": "pkg:vscode-extension/ms-python/python@2024.8.1",
  "properties": [
    { "name": "cdx:vscode-extension:ide", "value": "vscode" },
    {
      "name": "cdx:vscode-extension:activationEvents",
      "value": "onLanguage:python, onCommand:python.runLinting"
    },
    { "name": "cdx:vscode-extension:extensionKind", "value": "workspace" },
    {
      "name": "cdx:vscode-extension:extensionDependencies",
      "value": "ms-python.vscode-pylance"
    },
    { "name": "cdx:vscode-extension:untrustedWorkspaces", "value": "limited" },
    {
      "name": "cdx:vscode-extension:contributes",
      "value": "commands:count:42, debuggers:1, terminal-access"
    },
    { "name": "cdx:vscode-extension:main", "value": "./dist/extension.js" },
    {
      "name": "cdx:vscode-extension:lifecycleScripts",
      "value": "postinstall, vscode:prepublish"
    }
  ]
}

Alias and overlap notes

• The cdx:vscode-extension:ide property is set to the IDE name where the extension was discovered (for example vscode, cursor, vscodium, windsurf, positron). Extensions found from .vsix files do not have this property.
• cdx:vscode-extension:lifecycleScripts is analogous to cdx:npm:risky_scripts for npm packages — both capture install-time execution risk.
• cdx:vscode-extension:contributes is a summary list, not a full enumeration. The count suffix (for example commands:count:42) indicates how many contribution points exist in that category.
• Extensions discovered via osquery (-t os) use the same pkg:vscode-extension purl type and may also carry cdx:osquery:category.
• Chromium-browser extensions discovered via -t chrome-extension can include cdx:chrome-extension:browser, cdx:chrome-extension:channel, cdx:chrome-extension:profile, cdx:chrome-extension:profilePath, cdx:chrome-extension:manifestVersion, and cdx:chrome-extension:updateUrl.
• Chromium-browser extensions discovered via -t chrome-extension can include security-sensitive fields from real manifests: cdx:chrome-extension:permissions, cdx:chrome-extension:optionalPermissions, cdx:chrome-extension:hostPermissions, cdx:chrome-extension:optionalHostPermissions, cdx:chrome-extension:commands, cdx:chrome-extension:contentScriptsRunAt, cdx:chrome-extension:contentScriptsMatches, cdx:chrome-extension:contentSecurityPolicy, cdx:chrome-extension:storageManagedSchema, cdx:chrome-extension:webAccessibleResourceMatches, cdx:chrome-extension:externallyConnectableMatches, and cdx:chrome-extension:hasAutofill.
• Chromium-browser extensions can include capability booleans derived from manifest + Babel source analysis: cdx:chrome-extension:capability:fileAccess, cdx:chrome-extension:capability:deviceAccess, cdx:chrome-extension:capability:network, cdx:chrome-extension:capability:bluetooth, cdx:chrome-extension:capability:accessibility, cdx:chrome-extension:capability:codeInjection, and cdx:chrome-extension:capability:fingerprinting.
• Vendor-specific fields are namespaced explicitly: Edge (cdx:chrome-extension:edge:*) and Brave (cdx:chrome-extension:brave:*).
• Chrome extensions discovered via osquery (-t os) use pkg:chrome-extension and may also carry cdx:osquery:category.

Consumer-oriented views

CI/CD trust

• cdx:github:action:isShaPinned
• cdx:github:workflow:hasWritePermissions
• cdx:github:workflow:hasIdTokenWrite
• cdx:actions:isOfficial
• cdx:actions:isVerified
• cdx:gitlab:job:image
• cdx:azure:job:pool:vmImage
• cdx:circleci:orb:alias
• cdx:jenkins:agent:image

Dependency execution risk

• cdx:npm:hasInstallScript
• cdx:npm:risky_scripts
• cdx:npm:native_addon
• cdx:npm:native_deps
• cdx:gem:executables
• cdx:cargo:features

Non-registry or local source detection

• cdx:npm:isRegistryDependency
• cdx:npm:isLink
• cdx:npm:resolvedPath
• cdx:pypi:registry
• cdx:gem:remote
• cdx:gem:remoteRevision
• cdx:go:local_dir
• cdx:nix:input_url
• cdx:swift:localCheckoutPath
• cdx:pods:projectDir
• cdx:pub:registry

Reproducibility and drift

• cdx:github:action:versionPinningType
• cdx:pypi:latest_version
• cdx:gem:remoteRevision
• cdx:gem:remoteBranch
• cdx:nix:revision
• cdx:nix:nar_hash
• cdx:go:creation_time
• cdx:build:versionSpecifiers

BOM completeness and explainability

• cdx:bom:componentNamespaces
• cdx:bom:componentSrcFiles
• cdx:bom:componentTypes
• cdx:lolbas:names
• cdx:lolbas:riskTags
• cdx:container:riskTags
• cdx:container:offenseTools
• cdx:gtfobins:riskTags
• cdx:osquery:category
• cdx:service:httpMethod

IDE extension trust

• cdx:vscode-extension:lifecycleScripts
• cdx:vscode-extension:activationEvents
• cdx:vscode-extension:untrustedWorkspaces
• cdx:vscode-extension:virtualWorkspaces
• cdx:vscode-extension:contributes
• cdx:vscode-extension:extensionDependencies
• cdx:vscode-extension:extensionPack
• cdx:vscode-extension:extensionKind
• cdx:vscode-extension:ide

Browser extension trust

• cdx:chrome-extension:permissions
• cdx:chrome-extension:optionalPermissions
• cdx:chrome-extension:hostPermissions
• cdx:chrome-extension:optionalHostPermissions
• cdx:chrome-extension:contentScriptsRunAt
• cdx:chrome-extension:contentScriptsMatches
• cdx:chrome-extension:commands
• cdx:chrome-extension:capability:fileAccess
• cdx:chrome-extension:capability:deviceAccess
• cdx:chrome-extension:capability:network
• cdx:chrome-extension:capability:bluetooth
• cdx:chrome-extension:capability:accessibility
• cdx:chrome-extension:capability:codeInjection
• cdx:chrome-extension:capability:fingerprinting
• cdx:chrome-extension:hasAutofill

Trust material and signed-software review

• Repository source properties: cdx:os:repo:type, cdx:os:repo:url, cdx:os:repo:enabled, plus distro-specific repo keys such as cdx:os:repo:signedBy, cdx:os:repo:gpgkey, and cdx:os:repo:gpgcheck
• Cryptographic material properties: cdx:crypto:trustDomain, cdx:crypto:fingerprint, cdx:crypto:algorithm, cdx:crypto:keyStrength, cdx:crypto:createdAt, cdx:crypto:expiresAt, cdx:crypto:keyPath, cdx:crypto:fileExtension, cdx:crypto:keyId, cdx:crypto:userId, cdx:crypto:isCA
• macOS trust properties: cdx:darwin:codesign:identifier, cdx:darwin:codesign:format, cdx:darwin:codesign:teamIdentifier, cdx:darwin:codesign:signed, cdx:darwin:codesign:runtimeVersion, cdx:darwin:codesign:authorityCount, cdx:darwin:codesign:authority, cdx:darwin:notarization:assessment, cdx:darwin:notarization:source, cdx:darwin:notarization:origin, cdx:darwin:gatekeeper:status
• Windows trust properties: cdx:windows:authenticode:status, cdx:windows:authenticode:isOSBinary, cdx:windows:authenticode:statusMessage, cdx:windows:authenticode:signerSubject, cdx:windows:authenticode:signerIssuer, cdx:windows:authenticode:signerThumbprint, cdx:windows:authenticode:signerNotAfter, cdx:windows:authenticode:timestampSubject, cdx:windows:authenticode:timestampIssuer, cdx:windows:authenticode:timestampThumbprint, cdx:windows:wdac:activePolicyCount, cdx:windows:wdac:policyPath, cdx:windows:wdac:policySize, cdx:windows:wdac:lastModified
• Helper-native OS package trust properties: PackageArchitecture, PackageOrigin, PackageSource, PackageStatus

Native-field note: cdxgen now promotes OS package maintainer/vendor trust metadata into native CycloneDX component fields when possible: supplier, manufacturer, and authors. If those fields already exist with different values, cdxgen leaves the existing native values untouched and retains the fallback property only when needed to avoid dropping the conflicting observation.

Compatibility note: the six Package* keys above are emitted directly on OS-package components by the cdxgen Trivy wrapper for compatibility with existing container/rootfs processing. They are intentionally not cdx:-prefixed today, so policy authors should match the exact names shown here.

Entry template for future additions

When a new cdx: property is introduced, document it using this template so the inventory stays operational instead of becoming another flat list.

Key	Scope	Value type	Typical values	When emitted	Common policy use	Policy readiness	Notes
cdx:example:key	component / workflow / job / step / metadata / service	boolean string / list string / path / URL / timestamp / JSON string	"true", main, sha256-...	Trigger or parser stage that emits it	What policy authors should do with it	Hard deny / Warning / Context only	Aliases, overlaps, or compatibility guidance

Practical use-case patterns with policy examples

Below are realistic examples showing how to use attributes individually and in combination.

1) Block unpinned GitHub Actions in privileged workflows

Individual signal

• cdx:github:action:isShaPinned=false means the action reference is tag/branch-based, not commit-SHA pinned.

Combined signal

• Escalate severity when both are true:
  • cdx:github:action:isShaPinned=false
  • cdx:github:workflow:hasWritePermissions=true (or cdx:github:job:hasWritePermissions=true)

JSONata

components[
  $prop($, 'cdx:github:action:isShaPinned') = 'false'
  and (
    $prop($, 'cdx:github:workflow:hasWritePermissions') = 'true'
    or $prop($, 'cdx:github:job:hasWritePermissions') = 'true'
  )
]

OPA (Rego)

package cdxgen.policies

has_prop(c, name, value) {
  some p in c.properties
  p.name == name
  p.value == value
}

deny[msg] {
  some c in input.components
  has_prop(c, "cdx:github:action:isShaPinned", "false")
  msg := sprintf("Unpinned GitHub Action: %s", [c.purl])
}

deny[msg] {
  some c in input.components
  has_prop(c, "cdx:github:action:isShaPinned", "false")
  has_prop(c, "cdx:github:workflow:hasWritePermissions", "true")
  msg := sprintf("Unpinned action in write-permission workflow: %s", [c.purl])
}

CEL

// any unpinned action
input.components.exists(c,
  c.properties.exists(p, p.name == "cdx:github:action:isShaPinned" && p.value == "false")
)

// unpinned action + write permissions
input.components.exists(c,
  c.properties.exists(p, p.name == "cdx:github:action:isShaPinned" && p.value == "false") &&
  (
    c.properties.exists(p, p.name == "cdx:github:workflow:hasWritePermissions" && p.value == "true") ||
    c.properties.exists(p, p.name == "cdx:github:job:hasWritePermissions" && p.value == "true")
  )
)

2) Flag npm packages with install-time execution risk

Individual signals

• cdx:npm:hasInstallScript=true
• cdx:npm:risky_scripts contains lifecycle hooks (for example preinstall, postinstall)

Combined signal

• Raise priority when execution risk combines with non-registry source:
  • cdx:npm:hasInstallScript=true (or cdx:npm:risky_scripts present)
  • cdx:npm:isRegistryDependency=false

JSONata

components[
  $prop($, 'cdx:npm:hasInstallScript') = 'true'
  and $prop($, 'cdx:npm:isRegistryDependency') = 'false'
]

OPA (Rego)

package cdxgen.policies

has_prop(c, name, value) {
  some p in c.properties
  p.name == name
  p.value == value
}

warn[msg] {
  some c in input.components
  has_prop(c, "cdx:npm:hasInstallScript", "true")
  msg := sprintf("npm package has install script: %s", [c.purl])
}

deny[msg] {
  some c in input.components
  has_prop(c, "cdx:npm:hasInstallScript", "true")
  has_prop(c, "cdx:npm:isRegistryDependency", "false")
  msg := sprintf("npm package executes install script from non-registry source: %s", [c.purl])
}

CEL

input.components.exists(c,
  c.properties.exists(p, p.name == "cdx:npm:hasInstallScript" && p.value == "true") &&
  c.properties.exists(p, p.name == "cdx:npm:isRegistryDependency" && p.value == "false")
)

3) Enforce approved package registries and local-source policy

Individual signals

• cdx:pypi:registry appears when a non-default Python registry is used.
• cdx:pub:registry appears when a non-default Dart registry is used.
• cdx:swift:localCheckoutPath and cdx:pods:projectDir identify local dependency sources.

Combined signal

• Combine non-approved registries or local checkouts with environment-specific release policy.

JSONata

components[
  $hasProp($, 'cdx:pypi:registry')
  and not(
    $prop($, 'cdx:pypi:registry') = 'https://pypi.org/simple'
    or $prop($, 'cdx:pypi:registry') = 'https://pypi.org'
  )
]

OPA (Rego)

package cdxgen.policies

approved_registries := {
  "https://pypi.org/simple",
  "https://pypi.org",
}

deny[msg] {
  some c in input.components
  some p in c.properties
  p.name == "cdx:pypi:registry"
  not approved_registries[p.value]
  msg := sprintf("Unapproved PyPI registry for %s: %s", [c.purl, p.value])
}

deny[msg] {
  some c in input.components
  c.properties[_].name == "cdx:swift:localCheckoutPath"
  msg := sprintf("Swift local checkout is not allowed in release BOMs: %s", [c.purl])
}

CEL

input.components.exists(c,
  c.properties.exists(p, p.name == "cdx:pypi:registry" &&
    !(p.value in ["https://pypi.org/simple", "https://pypi.org"]))
)

4) Require reproducibility metadata for Nix and Go

Individual signals

• cdx:nix:revision
• cdx:nix:nar_hash
• cdx:go:local_dir

Combined signal

• Consider a Nix dependency policy-compliant only when both lock properties are present.
• Treat Go local replacements as non-hermetic unless explicitly allowed.

JSONata

components[
  $startsWith(purl, 'pkg:nix/')
  and (
    not($hasProp($, 'cdx:nix:revision'))
    or not($hasProp($, 'cdx:nix:nar_hash'))
  )
]

For go, use $hasProp($, 'cdx:go:local_dir')

OPA (Rego)

package cdxgen.policies

has_prop(c, name) {
  some p in c.properties
  p.name == name
}

deny[msg] {
  some c in input.components
  startswith(c.purl, "pkg:nix/")
  not has_prop(c, "cdx:nix:revision")
  msg := sprintf("Nix component missing revision: %s", [c.purl])
}

deny[msg] {
  some c in input.components
  startswith(c.purl, "pkg:nix/")
  not has_prop(c, "cdx:nix:nar_hash")
  msg := sprintf("Nix component missing nar_hash: %s", [c.purl])
}

deny[msg] {
  some c in input.components
  has_prop(c, "cdx:go:local_dir")
  msg := sprintf("Go component uses local replacement: %s", [c.purl])
}

CEL

input.components.exists(c,
  c.purl.startsWith("pkg:nix/") &&
  (
    !c.properties.exists(p, p.name == "cdx:nix:revision") ||
    !c.properties.exists(p, p.name == "cdx:nix:nar_hash")
  )
) ||
input.components.exists(c,
  c.properties.exists(p, p.name == "cdx:go:local_dir")
)

5) Gate BOM completeness before downstream signing/attestation

Individual signals

• cdx:bom:componentTypes
• cdx:bom:componentSrcFiles

Combined signal

• Require both metadata properties to exist before generating a “trusted” attestation.

JSONata

not(
  $count(metadata.properties[name = 'cdx:bom:componentTypes']) > 0
  and $count(metadata.properties[name = 'cdx:bom:componentSrcFiles']) > 0
)

OPA (Rego)

package cdxgen.policies

meta_has(name) {
  some p in input.metadata.properties
  p.name == name
}

deny[msg] {
  not meta_has("cdx:bom:componentTypes")
  msg := "BOM metadata missing cdx:bom:componentTypes"
}

deny[msg] {
  not meta_has("cdx:bom:componentSrcFiles")
  msg := "BOM metadata missing cdx:bom:componentSrcFiles"
}

CEL

!(input.metadata.properties.exists(p, p.name == "cdx:bom:componentTypes") &&
  input.metadata.properties.exists(p, p.name == "cdx:bom:componentSrcFiles"))

6) Tighten OIDC use to trusted GitHub actions only

Individual signals

• cdx:github:workflow:hasIdTokenWrite=true
• cdx:actions:isOfficial
• cdx:actions:isVerified

Combined signal

• Escalate when a workflow can mint OIDC tokens and the action is neither official nor otherwise trusted by organization policy.

JSONata

components[
  $prop($, 'cdx:github:workflow:hasIdTokenWrite') = 'true'
  and $prop($, 'cdx:actions:isOfficial') = 'false'
]

OPA (Rego)

package cdxgen.policies

has_prop(c, name, value) {
  some p in c.properties
  p.name == name
  p.value == value
}

deny[msg] {
  some c in input.components
  has_prop(c, "cdx:github:workflow:hasIdTokenWrite", "true")
  has_prop(c, "cdx:actions:isOfficial", "false")
  msg := sprintf("OIDC-enabled workflow references non-official action: %s", [c.purl])
}

CEL

input.components.exists(c,
  c.properties.exists(p, p.name == "cdx:github:workflow:hasIdTokenWrite" && p.value == "true") &&
  c.properties.exists(p, p.name == "cdx:actions:isOfficial" && p.value == "false")
)

7) Audit VS Code extensions for install-time execution and host access

Individual signals

• cdx:vscode-extension:lifecycleScripts present (especially containing postinstall) means the extension runs scripts during installation.
• cdx:vscode-extension:activationEvents containing * means the extension activates on every workspace open.
• cdx:vscode-extension:contributes containing terminal-access, filesystem-provider, or authentication-provider indicates privileged host interaction capabilities.

Combined signal

• Escalate when an always-on extension also has terminal access or lifecycle scripts:
  • cdx:vscode-extension:activationEvents contains *
  • cdx:vscode-extension:contributes contains terminal-access
  • cdx:vscode-extension:lifecycleScripts present

JSONata

components[
  $startsWith(purl, 'pkg:vscode-extension/')
  and $hasProp($, 'cdx:vscode-extension:lifecycleScripts')
]

OPA (Rego)

package cdxgen.policies

has_prop(c, name) {
  some p in c.properties
  p.name == name
}

prop_value(c, name) := v {
  some p in c.properties
  p.name == name
  v := p.value
}

deny[msg] {
  some c in input.components
  startswith(c.purl, "pkg:vscode-extension/")
  has_prop(c, "cdx:vscode-extension:lifecycleScripts")
  msg := sprintf("VS Code extension has lifecycle scripts: %s", [c.purl])
}

warn[msg] {
  some c in input.components
  startswith(c.purl, "pkg:vscode-extension/")
  v := prop_value(c, "cdx:vscode-extension:activationEvents")
  contains(v, "*")
  msg := sprintf("VS Code extension uses wildcard activation (always-on): %s", [c.purl])
}

deny[msg] {
  some c in input.components
  startswith(c.purl, "pkg:vscode-extension/")
  v := prop_value(c, "cdx:vscode-extension:activationEvents")
  contains(v, "*")
  cv := prop_value(c, "cdx:vscode-extension:contributes")
  contains(cv, "terminal-access")
  msg := sprintf("Always-on VS Code extension with terminal access: %s", [c.purl])
}

CEL

// extension with lifecycle scripts
input.components.exists(c,
  c.purl.startsWith("pkg:vscode-extension/") &&
  c.properties.exists(p, p.name == "cdx:vscode-extension:lifecycleScripts")
)

// always-on extension with terminal access
input.components.exists(c,
  c.purl.startsWith("pkg:vscode-extension/") &&
  c.properties.exists(p, p.name == "cdx:vscode-extension:activationEvents" && p.value.contains("*")) &&
  c.properties.exists(p, p.name == "cdx:vscode-extension:contributes" && p.value.contains("terminal-access"))
)

Notes for policy authors

• Prefer evaluating these as context enrichers rather than strict truth assertions unless you explicitly normalize missing-vs-false semantics.
• Treat workspace/local path indicators (isLink, resolvedPath, localCheckoutPath, projectDir, flake_dir, local_dir) as provenance signals that may require stronger trust controls.
• Treat execution-related indicators (risky_scripts, hasInstallScript, CI write permissions, OIDC enablement, action pinning type) as high-priority triage fields for software supply chain risk.
• Treat VS Code extension lifecycle scripts (cdx:vscode-extension:lifecycleScripts) with the same urgency as npm install scripts (cdx:npm:hasInstallScript); both represent install-time code execution risk. Wildcard activation events (*) combined with terminal access or filesystem provider contributions indicate extensions with broad host access capabilities.
• In Rego examples, use helper predicates such as has_prop(c, name, value) to ensure all property checks evaluate against the same component instance, avoiding unintended cross-component matches from repeated c.properties[_] array iteration.
• Match overlapping keys where noted (cdx:npm:isWorkspace and cdx:npm:is_workspace; Azure pool defaults and job overrides) so older and newer BOMs behave consistently in policy engines.