You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We usually reference the node binary with vendor + product nodejs/node (for example in our CPE) since we ship multiple packages under the node.js organization.
However the ecosystem references the node.js binary PURL as pkg:generic/node, you can verify this with a quick google search .
I believe the PURL should be pkg:generic/nodejs/node.
According to the PURL spec the namespace is optional, but I think it better represent our convention.
I'm writing this issue to seek agreement on our preferred PURL convention.
If we agree I'll send a PR to https://github.com/package-url/purl-registry/tree/main/registry/purl so tools can track our decision.
Dependening on the ouput of the conversation we should fix our purl in the vex file which is wrong because node is not a type so its against the spec.
Activity
marco-ippolito commentedon Mar 31, 2026
@nodejs/security-wg are we good with this?
github-actions commentedon Jun 30, 2026
This issue has been inactive for 90 days. It will be closed in 14 days unless there is further activity or the stale label is taken off.
github-actions commentedon Sep 29, 2026
This issue has been inactive for 90 days. It will be closed in 14 days unless there is further activity or the stale label is taken off.