@cdxgen/cdxgen 13.5.0 → 13.7.0

package/lib/inventory/citations.js

@@ -151,16 +151,45 @@ export function collectToolBomRefs(bomJson) {
   return refs;
 }
 
+// npm purl prefixes cdxgen's own tool entry has used as its bom-ref.
+const CDXGEN_TOOL_REF_PREFIXES = [
+  "pkg:npm/@cdxgen/cdxgen@",
+  "pkg:npm/%40cdxgen/cdxgen@",
+  "pkg:npm/@cyclonedx/cdxgen@",
+  "pkg:npm/%40cyclonedx/cdxgen@",
+];
+
 /**
  * Resolve the bom-ref of the cdxgen tool component, if present. This is the
  * canonical attribution target for inventory that cdxgen collected itself.
  *
+ * The tool component named "cdxgen" wins; a bare bom-ref (legacy array-style
+ * tools) counts when it is cdxgen's own npm purl. A helper whose bom-ref only
+ * mentions cdxgen, such as a cdxgen-plugins-bin tool like trustinspector, is
+ * never the cdxgen tool.
+ *
  * @param {Object} bomJson CycloneDX BOM
  * @returns {string|undefined} bom-ref of the cdxgen tool, or undefined
  */
 export function findCdxgenToolBomRef(bomJson) {
-  const refs = collectToolBomRefs(bomJson);
-  return refs.find((ref) => ref.includes("cdxgen"));
+  const tools = bomJson?.metadata?.tools;
+  const components = Array.isArray(tools)
+    ? tools
+    : Array.isArray(tools?.components)
+      ? tools.components
+      : [];
+  const named = components.find(
+    (component) =>
+      component?.name === "cdxgen" &&
+      typeof component["bom-ref"] === "string" &&
+      component["bom-ref"].length > 0,
+  );
+  if (named) {
+    return named["bom-ref"];
+  }
+  return collectToolBomRefs(bomJson).find((ref) =>
+    CDXGEN_TOOL_REF_PREFIXES.some((prefix) => ref.startsWith(prefix)),
+  );
 }
 
 /**