Definition

Package URL (purl)

Also: purl

A standard identifier for a software package across ecosystems, used to match SBOM components against vulnerability databases reliably.

A URL-shaped identifier of the form pkg:type/namespace/name@version that names a package precisely regardless of tooling — for example pkg:npm/lodash@4.17.20 or pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1. Vulnerability databases such as OSV index advisories by purl, so SBOM components with purls can be matched deterministically; components without them fall back to name heuristics that produce both misses and noise.

Reference: purl specification (package-url/purl-spec) · Regulation (EU) 2024/2847 on EUR-Lex

Updated 2026-09-30 · Paraphrase for orientation, not legal advice.