bug: having same package installed multiple times in parallel (due to aliasing) casues non-reproducible results (due to bomref-conflicts)

[dporf]

Describe the bug

Sometimes bom-ref is filled with random values:
"bom-ref": "BomRef.xxxxxxxxxxx.xxxxxxxxxx"

In that case every single run fills them with new value while reproducible output should be the same if no dependencies changed

Before I filled the issue I got differences only in bom-ref, but now in the test scenario I also have different components order

To Reproduce

npm i @angular/cli@17.0.0-next.4
npx @cyclonedx/cyclonedx-npm --output-reproducible -o bom1.json ./package.json
npx @cyclonedx/cyclonedx-npm --output-reproducible -o bom2.json ./package.json
diff bom1.json bom2.json

Expected behavior

There should be no difference between bom1.json and bom2.json (random used for generating bom-ref should be initialized with constant seed?)

Screenshots or output-paste

$ diff bom1.json bom2.json
96,98c96,98
<       "name": "string-width",
<       "version": "4.2.3",
<       "bom-ref": "BomRef.1711e4pa9j.9c4nbc8f4ho",
---
>       "name": "strip-ansi",
>       "version": "6.0.1",
>       "bom-ref": "BomRef.evnpgd0bt9o.91q2j4u80c",
100c100
<       "description": "Get the visual width of a string - the number of columns required to display it",
---
>       "description": "Strip ANSI escape codes from a string",
109c109
<       "purl": "pkg:npm/string-width@4.2.3",
---
>       "purl": "pkg:npm/strip-ansi@6.0.1",
112c112
<           "url": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
---
>           "url": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
117c117
<               "content": "c0ac90450a63274b08a7ad84ad265d1ac8cc256b1aa79a1136284786ee86ec954effd8c807a5327af2feb57b8eaab9e0f23fdcc4a4d6c96530bd24eb8a2673fe"
---
>               "content": "637f153d21dcaa416b0a916743dbee4979aabaebf9a1738aa46793e9a1abaf7a3719cf409556ba2417d448e0a76f1186645fbfd28a08ecaacfb944b3b54754e4"
123c123
<           "url": "https://github.com/sindresorhus/string-width/issues",
---
>           "url": "https://github.com/chalk/strip-ansi/issues",
128c128
<           "url": "git+https://github.com/sindresorhus/string-width.git",
---
>           "url": "git+https://github.com/chalk/strip-ansi.git",
133c133
<           "url": "https://github.com/sindresorhus/string-width#readme",
---
>           "url": "https://github.com/chalk/strip-ansi#readme",
141c141
<           "value": "node_modules/string-width-cjs"
---
>           "value": "node_modules/strip-ansi-cjs"
147,149c147,149
<       "name": "strip-ansi",
<       "version": "6.0.1",
<       "bom-ref": "BomRef.ettaoqr3rto.1ma10ouflso",
---
>       "name": "string-width",
>       "version": "4.2.3",
>       "bom-ref": "BomRef.jeaqmckbij8.upvv1sfkgto",
151c151
<       "description": "Strip ANSI escape codes from a string",
---
>       "description": "Get the visual width of a string - the number of columns required to display it",
160c160
<       "purl": "pkg:npm/strip-ansi@6.0.1",
---
>       "purl": "pkg:npm/string-width@4.2.3",
163c163
<           "url": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
---
>           "url": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
168c168
<               "content": "637f153d21dcaa416b0a916743dbee4979aabaebf9a1738aa46793e9a1abaf7a3719cf409556ba2417d448e0a76f1186645fbfd28a08ecaacfb944b3b54754e4"
---
>               "content": "c0ac90450a63274b08a7ad84ad265d1ac8cc256b1aa79a1136284786ee86ec954effd8c807a5327af2feb57b8eaab9e0f23fdcc4a4d6c96530bd24eb8a2673fe"
174c174
<           "url": "https://github.com/chalk/strip-ansi/issues",
---
>           "url": "https://github.com/sindresorhus/string-width/issues",
179c179
<           "url": "git+https://github.com/chalk/strip-ansi.git",
---
>           "url": "git+https://github.com/sindresorhus/string-width.git",
184c184
<           "url": "https://github.com/chalk/strip-ansi#readme",
---
>           "url": "https://github.com/sindresorhus/string-width#readme",
192c192
<           "value": "node_modules/strip-ansi-cjs"
---
>           "value": "node_modules/string-width-cjs"
11649c11649
<       "ref": "BomRef.1711e4pa9j.9c4nbc8f4ho",
---
>       "ref": "BomRef.evnpgd0bt9o.91q2j4u80c",
11651,11653c11651
<         "test|emoji-regex@8.0.0",
<         "test|is-fullwidth-code-point@3.0.0",
<         "test|strip-ansi@6.0.1"
---
>         "test|ansi-regex@5.0.1"
11657c11655
<       "ref": "BomRef.ettaoqr3rto.1ma10ouflso",
---
>       "ref": "BomRef.jeaqmckbij8.upvv1sfkgto",
11659c11657,11659
<         "test|ansi-regex@5.0.1"
---
>         "test|emoji-regex@8.0.0",
>         "test|is-fullwidth-code-point@3.0.0",
>         "test|strip-ansi@6.0.1"
11722,11723c11722,11723
<         "BomRef.1711e4pa9j.9c4nbc8f4ho",
<         "BomRef.ettaoqr3rto.1ma10ouflso",
---
>         "BomRef.evnpgd0bt9o.91q2j4u80c",
>         "BomRef.jeaqmckbij8.upvv1sfkgto",

Environment

$ npx @cyclonedx/cyclonedx-npm --version
4.0.2
$ npm --version
11.3.0
$ node --version
v22.14.0
$ uname -a
Linux NB-1732 6.6.87.2-microsoft-standard-WSL2 #1 SMP PREEMPT_DYNAMIC Thu Jun  5 18:30:46 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Additional context

Contribution

• I am willing to provide a fix
• I will wait until somebody else fixes it

[jkowalleck]

thanks for the report. will investigate and might come back later.

[jkowalleck]

interesting find:
strip-ansi was installed twice, once as strip-ansi-cjs and once as strip-ansi.
the reason is that `` installes the package with an alias ...
so we end up with two instances of the same package installed, each time with a different name - and when we read the package.json to craft a BomRef, we craft the same value twice - which is later discriminated - so a one of them gets a unique, random name.

https://www.npmjs.com/package/@isaacs/cliui?activeTab=code package.json

"dependencies": {
    "string-width": "^5.1.2",
    "string-width-cjs": "npm:string-width@^4.2.0",
    "strip-ansi": "^7.0.1",
    "strip-ansi-cjs": "npm:strip-ansi@^6.0.1",
    "wrap-ansi": "^8.1.0",
    "wrap-ansi-cjs": "npm:wrap-ansi@^7.0.0"
  }

and we already have a strip-ansi on top-most level ..

see lock file
package-lock.json

[jkowalleck]

possible fix: incorporate the (unique) file path into the BomRef?
downside: this would be a potentially breaking change.

[jkowalleck]

fix was released via https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v4.0.3