{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a1c48e8a-34d0-4c12-a669-7dbee225dcd6",
  "version": 1,
  "metadata": {
    "timestamp": "2026-01-01T00:00:00Z",
    "component": {
      "type": "application",
      "bom-ref": "pkg:npm/%40orchard-example/gateway@4.2.0",
      "name": "@orchard-example/gateway",
      "version": "4.2.0",
      "purl": "pkg:npm/%40orchard-example/gateway@4.2.0",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "cde01f0c8ff9d62ef958a3de288a2f1084db14bd47e1e10ff39a52412cca613f"
        }
      ],
      "supplier": {
        "name": "Example Softworks (fictional)",
        "url": [
          "https://sbom.orchard.example/supplier"
        ]
      },
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.orchard.example/@orchard-example/gateway/-/gateway-4.2.0.tgz"
        },
        {
          "type": "vcs",
          "url": "https://git.orchard.example/gateway"
        }
      ]
    },
    "properties": [
      {
        "name": "novus:sample",
        "value": "Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists."
      }
    ]
  },
  "vulnerabilities": [
    {
      "bom-ref": "vex-novus-sample-2026-0001",
      "id": "NOVUS-SAMPLE-2026-0001",
      "source": {
        "name": "NOVUS-SAMPLE",
        "url": "https://advisories.orchard.example/NOVUS-SAMPLE-2026-0001"
      },
      "ratings": [
        {
          "source": {
            "name": "NOVUS-SAMPLE"
          },
          "score": 8.1,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "analysis": {
        "state": "exploitable",
        "response": [
          "update"
        ],
        "detail": "SAMPLE analysis — fixture only."
      },
      "affects": [
        {
          "ref": "pkg:npm/example-logger@3.4.1"
        }
      ]
    },
    {
      "bom-ref": "vex-novus-sample-2026-0002",
      "id": "NOVUS-SAMPLE-2026-0002",
      "source": {
        "name": "NOVUS-SAMPLE",
        "url": "https://advisories.orchard.example/NOVUS-SAMPLE-2026-0002"
      },
      "ratings": [
        {
          "source": {
            "name": "NOVUS-SAMPLE"
          },
          "score": 9.3,
          "severity": "critical",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "SAMPLE analysis — fixture only."
      },
      "affects": [
        {
          "ref": "pkg:npm/example-cache@0.9.2"
        }
      ]
    },
    {
      "bom-ref": "vex-novus-sample-2026-0003",
      "id": "NOVUS-SAMPLE-2026-0003",
      "source": {
        "name": "NOVUS-SAMPLE",
        "url": "https://advisories.orchard.example/NOVUS-SAMPLE-2026-0003"
      },
      "ratings": [
        {
          "source": {
            "name": "NOVUS-SAMPLE"
          },
          "score": 5.4,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "analysis": {
        "state": "resolved",
        "response": [
          "update"
        ],
        "detail": "SAMPLE analysis — fixture only."
      },
      "affects": [
        {
          "ref": "pkg:npm/example-yaml-lite@1.1.7"
        }
      ]
    },
    {
      "bom-ref": "vex-novus-sample-2026-0004",
      "id": "NOVUS-SAMPLE-2026-0004",
      "source": {
        "name": "NOVUS-SAMPLE",
        "url": "https://advisories.orchard.example/NOVUS-SAMPLE-2026-0004"
      },
      "ratings": [
        {
          "source": {
            "name": "NOVUS-SAMPLE"
          },
          "score": 3.1,
          "severity": "low",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L"
        }
      ],
      "analysis": {
        "state": "false_positive",
        "response": [
          "will_not_fix"
        ],
        "detail": "SAMPLE analysis — fixture only."
      },
      "affects": [
        {
          "ref": "pkg:npm/example-json-path@2.0.5"
        }
      ]
    }
  ]
}