licence report with Bomdesk
This opens a sample package-lock.json in the licence view. Click any row to see how its licence expression was read, or press Scan to look up what the file leaves out.
- Paste package-lock.json (version 2 or 3 carries licences already).
- Press Scan to fill in anything the file leaves out.
- Use the filter to show copyleft or unknown licences first.
- Download the CSV for a spreadsheet or an auditor.
What to know
Tools such as license-checker read the packages installed in node_modules, so you have to install first. Bomdesk reads the lockfile instead, which is quicker and works on a project you only have the lock for.
Each licence is read as an SPDX expression. MIT OR Apache-2.0 is permissive because you can choose; MIT AND GPL-3.0-only is strong copyleft because both apply. A few values are not licences at all: UNLICENSED means no permission is granted, and SEE LICENSE IN LICENSE.md points at a file this page cannot read, so both are flagged instead of being treated as permissive.
The classes are Permissive, Weak copyleft (for example LGPL and MPL, which mostly cover changes to the library itself), Strong copyleft (GPL), Network copyleft (AGPL), Restricted (source-available or non-commercial terms) and Unknown. They are a reading aid and not legal advice.
Updated · Cosmovex
Questions
Do I need to run npm install first?
No. The lockfile has the package list, and licences are either in it (lockfile v2 and v3) or looked up by name and version.
What does UNLICENSED mean?
In npm it means no licence is granted for reuse. It is shown as Restricted so it cannot hide in a permissive-looking list.
Is a weak copyleft licence a problem?
It depends on how you use the library and how you ship it. The class tells you which ones to look at, not what to do.
How accurate is the licence data?
It is only as accurate as what each package declares. A package can declare MIT while including code under another licence; scanners that read source files can find that, and this page does not.
The free plan covers everything on this page. Bomdesk Pro ($19, paid once) is described on the Bomdesk page.
