CycloneDX SBOM, Truncated — Intentionally Corrupt
An intentionally corrupt CycloneDX SBOM: a valid 1.6 document cut off mid-object so the JSON never closes. Small on purpose — it exists to check that a reader fails cleanly instead of half-loading a component list. Every package, version, hash and licence is fictional — the tree describes nothing real.
{
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"serialNumber": "urn:uuid:ef02ea57-bf4b-4d01-a155-9431c4783575",
"version": 1,
"metadata": {
"timestamp": "2026-01-01T00:00:00Z",
"tools": {
"components": [
{
"type": "application",
"name": "novus-sbom-fixture",
"version": "1.0.0"
}
]
},
"authors": [
{
"name": "Orchard SBOM Team (fictional)",
"email": "sbom@orchard.example"
}
],
"component": {
"type": "application",
"bom-ref": "pkg:npm/%40orchard-example/gateway@4.2.0",
"name": "@orchard-example/gateway",
"version": "4.2.0",
"purl": "pkg:npm/%40orchard-example/gateway@4.2.0",
"licenses": [
{
"license": {
"id": "Apache-2.0"
}
}
],
"hashes": [
{
"alg": "SHA-256",
"content": "cde01f0c8ff9d62ef958a3de288a2f1084db14bd47e1e10ff39a52412cca613f"
}
],
"supplier": {
"name": "Example Softworks (fictional)",
"url": [
"https://sbom.orchard.example/supplier"
]
},
"external
Specifications
- Seed
- 51200
- Sample Only
- true
- Format
- CycloneDX
- Spec Version
- 1.6
- Damage
- truncated mid-object
- Intentionally Corrupt
- true
- Line Endings
- LF
Testing contract
Expected to fail- Scenario
- Feed a truncated SBOM to a parser that streams rather than buffers.
- Expected result
- Parsing raises a clear unexpected-end-of-input error and no partial component list is committed to the caller.
What is a .json file?
JSON (JavaScript Object Notation) is a lightweight, text-based data-interchange format representing objects, arrays, strings, numbers, booleans, and null. It is language-independent, human-readable, and the dominant format for web APIs and configuration. It requires a single well-formed root value.
How to use this file
Use an example JSON file to test parsers and serializers, schema validation, Unicode and number-precision handling, and API request or response processing.
How to use this file for testing
“CycloneDX SBOM, Truncated — Intentionally Corrupt” is a deterministic Novus Examples fixture for Error handling, JSON parsing. Deliberately corrupt and invalid files, clearly labelled, for testing how your tool fails.
Documented properties for this file: seed 51200 · damage: truncated mid-object · LF · intentionally corrupt. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Code examples
import json
with open("cyclonedx-1.6-truncated.json") as f:
data = json.load(f)
print(type(data), len(data))Related files
- jsonCycloneDX 1.6 Minimal SBOM (One Component)The smallest CycloneDX document that is still valid: required metadata, one fictional component, and no dependencies array — for testing that a reader handles an SBOM with nothing optional present. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonCycloneDX SBOM With Unicode Metadata (Edge Case)A CycloneDX SBOM whose author names and properties contain accented Latin, CJK, right-to-left Hebrew, emoji and a deliberately long property value — for testing encoding handling and field-width assumptions. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonDependency Alerts Feed (JSON)The shape a hosted dependency-alert API returns: alerts with lifecycle state, a nested advisory, a patched-version pointer and an explicitly null dismissed_reason on the alerts that were not dismissed. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
- jsonDependency Graph With a Cycle (JSON)A dependency graph containing a genuine three-node cycle between fictional plugins — the fixture that makes a naive recursive walker hang or blow the stack, with the cycle path stated so the expected answer is unambiguous. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonDSSE Envelope With Undecodable Payload — Intentionally CorruptAn intentionally corrupt DSSE envelope: the JSON parses and the signature block looks complete, but the payload is truncated and contains characters outside the base64 alphabet. Signatures, key ids and certificates here are SAMPLE placeholders — the base64 decodes to the words 'SAMPLE SIGNATURE', so verification must fail. Nothing here is cryptographically valid and no key material is real.
- jsonnpm audit Report (v1, Legacy Shape)The legacy npm audit shape — numeric advisory ids, a separate actions array and dependency paths written with '>' — which tools built for the v2 report silently read as zero findings. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
Generated by generation/supply_chain.py. Free for any use, no attribution required — license.