Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

BOM files in cyclonedx format created by npm-sbom contain an invalid statically UUID value in the serialNumber field:

"serialNumber": "urn:uuid:***",

The problem is, that some tools checking the serialNumber with regular expressions (^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$)

With this tools a box file create by npm-sbom can't be used.

Expected Behavior

serialNumber field should contain a valid UUID value

Steps To Reproduce

1. Create any BOM file with npm-sbom
2. Look up serialNumber field value

Environment

• npm: 11.6.4
• Node.js: 24.11.0
• OS Name: Windows