spdxcdx

Convert SPDX 2.x SBOMs to CycloneDX 1.6.

Library

import { readFile } from 'node:fs/promises';
import { parseSpdx, convertSpdxToCdx } from '@runsafesecurity/spdxcdx';

const spdx = await parseSpdx(await readFile('sbom.spdx'), {
  format: 'auto',
  fileName: 'sbom.spdx',
});
const cdx = await convertSpdxToCdx(spdx, { validate: true });

validate: true checks the result with @cyclonedx/cyclonedx-library (Ajv). Default is off.

JSON input requires Node only. Tag:value and RDF/XML input require Python 3 and pyspdxtools from spdx-tools on PATH.

CLI

yarn build
# Auto-detect JSON, tag:value, or RDF/XML input.
node dist/cli.js convert -i samples/spdx/minimal.spdx -o /tmp/out.cdx.json --validate
# Or select a format explicitly.
node dist/cli.js convert -i samples/spdx/minimal.spdx.rdf --input-format rdfxml -o /tmp/out.cdx.json --validate
# or, after install:
spdxcdx convert -i sbom.spdx.json --input-format json -o sbom.cdx.json --validate

Use - for stdin/stdout.

Field mapping

| Artifact | Path | |----------|------| | Mapping design | docs/superpowers/specs/2026-07-16-spdx-to-cdx-mapping-design.md | | Conversion engine design | docs/superpowers/specs/2026-07-16-spdx-to-cdx-conversion-engine-design.md | | Human matrices | docs/mapping/spdx-2-to-cdx-1.6.md | | Machine companion | src/mappings/spdx-2-to-cdx-1.6.yaml |

Development

yarn install
yarn test
yarn test:coverage
yarn build

Node >=26.5.0. Sample fixtures: samples/spdx/ (curated) and samples/spdx/real-world/ (downloaded open-source SPDX JSON SBOMs). Alternate-format integration tests require Python with spdx-tools==0.8.5 (pyspdxtools) on PATH; .venv-spdx is supported.

Contributing

Contributions are welcome. By submitting a contribution, you agree that:

1. Changes maintain 100% code coverage (yarn test:coverage)
2. Changes meet the project's lint standards (yarn lint:check)
3. All contributions are MIT licensed

License

MIT