diff --git a/examples/npm-lock/.dockerignore b/examples/npm-lock/.dockerignore
index f3d6549d..f0345687 100644
--- a/examples/npm-lock/.dockerignore
+++ b/examples/npm-lock/.dockerignore
@@ -1 +1,2 @@
-/build/
\ No newline at end of file
+/build/
+/node_modules/
\ No newline at end of file
diff --git a/examples/npm-lock/.gitignore b/examples/npm-lock/.gitignore
new file mode 100644
index 00000000..3c3629e6
--- /dev/null
+++ b/examples/npm-lock/.gitignore
@@ -0,0 +1 @@
+node_modules
diff --git a/examples/npm-lock/Dockerfile b/examples/npm-lock/Dockerfile
index 0c93b747..eb7c7a53 100644
--- a/examples/npm-lock/Dockerfile
+++ b/examples/npm-lock/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-# Copyright 2022 buildkit-syft-scanner authors
+# Copyright 2024 buildkit-syft-scanner authors
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,6 +14,10 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM scratch
+FROM scratch AS base
+COPY package-lock.json .
+COPY <<EOF /empty
+EOF
 
-COPY package-lock.json /package-lock.json
\ No newline at end of file
+FROM scratch
+COPY --from=base /empty /
diff --git a/examples/npm-lock/checks/sbom-base.spdx.json b/examples/npm-lock/checks/sbom-base.spdx.json
new file mode 100644
index 00000000..1b6baa9e
--- /dev/null
+++ b/examples/npm-lock/checks/sbom-base.spdx.json
@@ -0,0 +1,14 @@
+{
+  "_type": "https://in-toto.io/Statement/v0.1",
+  "predicateType": "https://spdx.dev/Document",
+  "predicate": {
+    "SPDXID": "SPDXRef-DOCUMENT",
+    "name": "sbom-base",
+    "packages": [
+      {
+        "SPDXID": "=package",
+        "name": "lodash"
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/examples/npm-lock/checks/sbom.spdx.json b/examples/npm-lock/checks/sbom.spdx.json
index 4d76999a..cd40a5cf 100644
--- a/examples/npm-lock/checks/sbom.spdx.json
+++ b/examples/npm-lock/checks/sbom.spdx.json
@@ -3,16 +3,6 @@
   "predicateType": "https://spdx.dev/Document",
   "predicate": {
     "SPDXID": "SPDXRef-DOCUMENT",
-    "name": "sbom",
-    "packages": [
-      {
-        "SPDXID": "=package",
-        "name": "lodash"
-      },
-      {
-        "SPDXID": "=package",
-        "name": "npm"
-      }
-    ]
+    "name": "sbom"
   }
 }
\ No newline at end of file
diff --git a/examples/npm-lock/package-lock.json b/examples/npm-lock/package-lock.json
index 19e03529..db7aad5a 100644
--- a/examples/npm-lock/package-lock.json
+++ b/examples/npm-lock/package-lock.json
@@ -1,13 +1,12 @@
 {
-  "name": "npm",
+  "name": "npm-lock",
   "version": "1.0.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
-      "name": "npm",
+      "name": "npm-lock",
       "version": "1.0.0",
-      "license": "ISC",
       "dependencies": {
         "lodash": "^4.17.21"
       }
@@ -15,8 +14,7 @@
     "node_modules/lodash": {
       "version": "4.17.21",
       "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
-      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
-      "license": "MIT"
+      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg=="
     }
   }
 }
diff --git a/examples/npm-lock/package.json b/examples/npm-lock/package.json
new file mode 100644
index 00000000..bb54707b
--- /dev/null
+++ b/examples/npm-lock/package.json
@@ -0,0 +1,8 @@
+{
+  "name": "npm-lock",
+  "version": "1.0.0",
+  "description": "BuildKit Syft Scanner",
+  "dependencies": {
+    "lodash": "^4.17.21"
+  }
+}