{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:bead702c-fc09-5e88-85aa-8335307f4950",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/basic-auth-connect@1.0.0",
      "type": "library",
      "name": "basic-auth-connect",
      "version": "1.0.0",
      "purl": "pkg:npm/basic-auth-connect@1.0.0"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:df86673a-06d7-589f-9f2c-babe522d38ed",
      "id": "CVE-2016-2515",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2016-2515 is a false positive for basic-auth-connect 1.0.0. false_positive \u2014 CVE-2016-2515 concerns the 'hawk' package (HMAC authentication library), but the target repository is 'basic-auth-connect' (HTTP Basic authentication middleware). These are completely different authentication packages. No hawk code, dependency, or vendored copy exists in the target repository."
      },
      "affects": [
        {
          "ref": "pkg:npm/basic-auth-connect@1.0.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:454a7d1a-f3f6-5747-8248-580b231ce9ea",
      "id": "CVE-2017-20162",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2017-20162 is a false positive for basic-auth-connect 1.0.0. false_positive \u2014 CVE-2017-20162 concerns the vercel/ms library (time string parsing utility), but the target repository is basic-auth-connect (authentication middleware). The affected ms library code is completely absent from this repository - not as the project itself, not as a vendored copy, and not as a declared dependency. This is a wrong-project match."
      },
      "affects": [
        {
          "ref": "pkg:npm/basic-auth-connect@1.0.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:faa82311-0aab-5b27-af2c-a4c83923f807",
      "id": "CVE-2018-3739",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2018-3739 is a false positive for basic-auth-connect 1.0.0. false_positive \u2014 CVE-2018-3739 concerns the 'https-proxy-agent' npm package, but the target repository is 'basic-auth-connect', a completely different package implementing HTTP Basic Authentication middleware. The affected component is absent from the entire repository."
      },
      "affects": [
        {
          "ref": "pkg:npm/basic-auth-connect@1.0.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1ef05f5c-6438-506f-ae07-e3afea845fc2",
      "id": "CVE-2021-33623",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2021-33623 is a false positive for basic-auth-connect 1.0.0. false_positive \u2014 CVE-2021-33623 is a wrong-project match. The CVE affects the trim-newlines package (a string manipulation utility with ReDoS vulnerability), but the target repository is basic-auth-connect (a basic authentication middleware for Node.js/Connect). No relationship exists between these projects."
      },
      "affects": [
        {
          "ref": "pkg:npm/basic-auth-connect@1.0.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:041f49b6-718c-591a-8050-d2aa88c49ec0",
      "id": "CVE-2022-29167",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2022-29167 is a false positive for basic-auth-connect 1.0.0. false_positive \u2014 CVE-2022-29167 concerns the Hawk HTTP authentication library, but the target repository is basic-auth-connect, a completely different authentication middleware. This is a wrong-project match with no code relationship between the two libraries."
      },
      "affects": [
        {
          "ref": "pkg:npm/basic-auth-connect@1.0.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d8707c68-1e8a-5959-8b34-27465942ae31",
      "id": "GHSA-pc5p-h8pf-mvwp",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-pc5p-h8pf-mvwp is a false positive for basic-auth-connect 1.0.0. false_positive \u2014 This is a wrong-project match. The CVE GHSA-pc5p-h8pf-mvwp concerns the npm package 'https-proxy-agent', but this repository is 'basic-auth-connect', a completely different package that implements HTTP Basic Authentication middleware. No dependency relationship, vendored copy, or code overlap exists between these two projects."
      },
      "affects": [
        {
          "ref": "pkg:npm/basic-auth-connect@1.0.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:32a8ea8a-0064-5a0d-8d41-c2e3f42e6e84",
      "id": "GHSA-qrg3-f6h6-vq8q",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-qrg3-f6h6-vq8q is a false positive for basic-auth-connect 1.0.0."
      },
      "affects": [
        {
          "ref": "pkg:npm/basic-auth-connect@1.0.0"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/basic-auth-connect@1.0.0"
    }
  ]
}