2.5.0 regression: CycloneDX SBOM scanning drops package namespace (npm scope)

Since v2.5.0, scanning a CycloneDX SBOM with -L strips the namespace from package names. @aws-sdk/client-lambda is queried against osv.dev as client-lambda.

This causes both:

False positives: our scoped npm packages now match typosquat malware advisories published for the unscoped name.
False negatives: real advisories for namespaced packages are never queried at all.

v2.4.0 handles these correctly.

Minimal repro:

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "version": 1,
  "components": [
    {
      "type": "library",
      "bom-ref": "pkg:npm/%40aws-sdk/client-lambda@3.1037.0",
      "group": "@aws-sdk",
      "name": "client-lambda",
      "version": "3.1037.0",
      "purl": "pkg:npm/%40aws-sdk/client-lambda@3.1037.0"
    }
  ]
}

Also having this issue!

fix(ci): pin osv scanner to v2.4.0 (#88)

Hello! Thank you for raising the issue.

The fix is in osv-scalibr#2356, but it may take a few days to propagate to osv-scanner.
We aim to release v2.5.1 soon and will keep you posted in this thread.
In the meantime, please pin your osv-scanner version to v2.4.0.

Apologies for the inconvenience!

Hi, the fix is now available in the newly released v2.5.1.
I'll go ahead and close this issue, but feel free to reopen or comment if the problem persists after updating.
Thanks again for your report and patience!

!16973 merge bump-osv-scanner-2.5.1 into main

Navigation Menu

Repository navigation

2.5.0 regression: CycloneDX SBOM scanning drops package namespace (npm scope) #2978

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

2.5.0 regression: CycloneDX SBOM scanning drops package namespace (npm scope) #2978

Description

Activity

grehnen commented on Aug 10, 2026

Ly-Joey commented on Aug 12, 2026

Ly-Joey commented on Aug 17, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions