@jkowalleck , note that I've basically guessed what could be right. It would be good if you or somebody else from your team could add a few tests cases.

[...] could add a few tests cases.

Please add test cases yourself,
they go here:

Please find a description how snapshot-generation works: https://github.com/CycloneDX/cyclonedx-javascript-library/tree/main/tests

thank you in advance

Check the provided test cases carefully to ensure they expect what should actually happen.

I've also added the npm run build command to the instructions as this was a huge time waster for me. Apparently the build task gets called automatically by npm install for whatever reason but needs to be called manually thereafter. Maybe this is just natural for NPM users but was unexpected for me.

re: #1020 (comment)

Thank you for your effort.
Now that you are kind-of familiar with the internals, feel free to pullrequest any missing feature you need 😁

See the following as some background information:

the build task gets called automatically by npm install for whatever reason.

This is to enable a usage of the package by install-from-source. This comes in handy when you want to integrate a feature branch locally in an isolated environment.
This is also to enable a feast and easy setup for people who just want to try the examples.

[...] needs to be called manually [...]

this project does test the actual build result, and therefore build and test are decoupled. You need to run both processes manually. As you already found out.
I know many projects have an auto-detected just-in-time partial-build process in memory/temp-dirs, which is error prone and lacks of testing the actual build results. This project does it properly. ;-)