Can not run without package-lock.json

[SandZn]

Please try the package meow, which does not offer a package-lock.json file.

I got an Error after I globally installed @cyclonedx/cyclonedx-npm and ran cyclonedx-npm --omit dev --output-file newbom.json.

Error: missing package lock file or npm shrinkwrap file

[jkowalleck]

SBOM is about the components your software actually ships or bundles.
Without a lockfile or without installing, it is unclear which versions of unpinned(unlocked) dependencies are intended to be actually used. Unless NPM resolved your dependnecies it is unclear which versions were actually used.

I see your project being a library, rather than an ready-to-go application or a library with bundled dependencies. Your code has no real control over the actual components used on the end-user's side, right?
Then an SBOM might nor be a thing you would consider for your use case.

[jkowalleck]

Nevertheless, i will take your question as a hint, that the error reporting at this point could be improved. 👍
WiIll add a hint that the user might have forgotten to run npm install.