{"id":18064805,"url":"https://github.com/franciscop/check-licenses","last_synced_at":"2025-04-11T18:11:10.189Z","repository":{"id":57197458,"uuid":"318520159","full_name":"franciscop/check-licenses","owner":"franciscop","description":"A simple tool to check all the licenses in your dependencies","archived":false,"fork":false,"pushed_at":"2022-11-04T09:45:53.000Z","size":151,"stargazers_count":22,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-25T14:05:49.746Z","etag":null,"topics":["analyze","check","legal","licenses","npm"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/franciscop.png","metadata":{"files":{"readme":"readme.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null},"funding":{"custom":"https://www.paypal.me/franciscopresencia/19"}},"created_at":"2020-12-04T13:09:55.000Z","updated_at":"2024-11-13T16:41:43.000Z","dependencies_parsed_at":"2023-01-21T18:46:36.013Z","dependency_job_id":null,"html_url":"https://github.com/franciscop/check-licenses","commit_stats":null,"previous_names":[],"tags_count":11,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/franciscop%2Fcheck-licenses","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/franciscop%2Fcheck-licenses/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/franciscop%2Fcheck-licenses/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/franciscop%2Fcheck-licenses/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/franciscop","download_url":"https://codeload.github.com/franciscop/check-licenses/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248103902,"owners_count":21048244,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["analyze","check","legal","licenses","npm"],"created_at":"2024-10-31T06:07:49.878Z","updated_at":"2025-04-11T18:11:10.170Z","avatar_url":"https://github.com/franciscop.png","language":"JavaScript","funding_links":["https://www.paypal.me/franciscopresencia/19"],"categories":[],"sub_categories":[],"readme":"# Check Licenses [![npx check-licenses](https://img.shields.io/badge/npx-check--licenses-blue.svg)](https://www.npmjs.com/package/check-licenses) [![test badge](https://github.com/franciscop/check-licenses/workflows/tests/badge.svg)](https://github.com/franciscop/check-licenses/blob/master/.github/workflows/tests.yml)\n\nA simple tool to check all the licenses in your dependencies:\n\n\u003cimg src=\"./assets/demo.webp\" alt=\"Example command\" width=\"400px\" /\u003e\n\n- Find all dependencies and their sub-dependencies in your project\n- Validate both the `package.json` and the `LICENSE` file per dependency\n- Only reads `dependencies` and not `devDependencies`\n- Uses `package-lock.json` for deterministic resolution\n- Handles multiple versions of the same library just fine\n\n## Getting started\n\nYou can either use `npx check-licenses`, or install this library globally and then run it at once:\n\n```bash\nnpm i check-licenses -g\nlicenses   # Note how this is just `licenses`\nlicenses --list\nlicenses --help\n\n# Or use the library straight from npm\nnpx check-licenses\nnpx check-licenses --list\nnpx check-licenses --help\nnpx --yes check-licenses   # To avoid being asked to install it, e.g. in a CI\n```\n\nThe main command will trigger a license summary:\n\n```bash\n$ licenses\nMIT —————————————————— 56\nISC —————————————————— 7\nCC0-1.0 —————————————— 4\nBSD-2-Clause ————————— 2\nApache-1.0 ——————————— 2\nApache-2.0 ——————————— 2\nCC-BY-3.0 ———————————— 1\n```\n\nIf you want to dig deeper and see which package uses what license, use the `--list` flag.\n\n## Show the licenses used\n\nThe base command is to count how many licenses of each type are in use:\n\n```bash\n$ licenses\nMIT —————————————————— 1328\nISC —————————————————— 113\nCC0-1.0 —————————————— 36\nBSD-3-Clause ————————— 36\nApache-2.0 ——————————— 5\nBSD-2-Clause ————————— 3\nZlib ————————————————— 1\nCC-BY-3.0 ———————————— 1\nGPL-2.0 —————————————— 1\n```\n\n## List all dependencies\n\nThis can be used to find out what each of our dependencies (direct and indirect) is using. It might list multiple licenses in a single package:\n\n```bash\n$ licenses --list\n...\ntest-exclude@5.2.3 ————————————— ISC\ntext-table@0.2.0 ——————————————— MIT\ntextarea-caret@3.0.2 ——————————— MIT\nthroat@4.1.0 ——————————————————— MIT\nthrough@2.3.8 —————————————————— Apache-2.0 + MIT\nthrough2@2.0.5 ————————————————— MIT\nthunky@1.1.0 ——————————————————— MIT\ntimers-browserify@2.0.11 ——————— MIT\n...\n```\n\nThis list is normally quite long, but it can be easily `grep`-ed. For example, to find all of the `Apache-2.0` licenses:\n\n```bash\n$ licenses --list | grep Apache-2.0\nfb-watchman@2.0.1 —————————————— Apache-2.0\nforever-agent@0.6.1 ———————————— Apache-2.0\nformik@2.1.5 ——————————————————— Apache-2.0 + MIT\nharmony-reflect@1.6.1 —————————— Apache-2.0 + MPL-1.1\nhuman-signals@1.1.1 ———————————— Apache-2.0\n```\n\nIf there are multiple licenses in a library it's marked with a `+`. You can indeed also grep that!\n\n```bash\n$ licenses --list | grep +\n...\nare-we-there-yet@1.1.5 ————————— ISC + MIT\natob@2.1.2 ————————————————————— Apache-2.0 + MIT\ndetect-node@2.0.4 —————————————— ISC + MIT\nelectron-to-chromium@1.3.534 ——— ISC + MIT\nformik@2.1.5 ——————————————————— Apache-2.0 + MIT\nfs.realpath@1.0.0 —————————————— ISC + MIT\nharmony-reflect@1.6.1 —————————— Apache-2.0 + MPL-1.1\njson-schema@0.2.3 —————————————— AFLv2.1 + BSD\nkillable@1.0.1 ————————————————— ISC + MIT\nlodash-es@4.17.15 —————————————— CC0-1.0 + MIT\nlodash.memoize@4.1.2 ——————————— CC0-1.0 + MIT\n...\n```\n\n## Finding bad licenses\n\nLet's say you run this tool and find the dependencies, of which you really don't want to follow CC-BY-3.0:\n\n```bash\n$ licenses\nDOC —————————————————— 56\nMIT —————————————————— 56\nISC —————————————————— 7\nCC0-1.0 —————————————— 4\nBSD-2-Clause ————————— 2\nApache-1.0 ——————————— 2\nApache-2.0 ——————————— 2\nCC-BY-3.0 ———————————— 1\n```\n\nThen you can also use it to track down which dependencies have this license:\n\n```bash\n$ licenses --list | grep CC-BY-3.0\nspdx-exceptions@2.3.0 ——————— CC-BY-3.0\n```\n\nWith this information you can either:\n\n- Dig deeper: some times it might be dual-licensed\n- Find out where this comes from with `npm ls`:\n\n```bash\n$ npm ls spdx-exceptions\ncheck-licenses@0.2.0 /home/francisco/check-licenses\n└─┬ meow@8.0.0\n  └─┬ normalize-package-data@3.0.0\n    └─┬ validate-npm-package-license@3.0.4\n      └─┬ spdx-expression-parse@3.0.1\n        └── spdx-exceptions@2.3.0\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffranciscop%2Fcheck-licenses","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffranciscop%2Fcheck-licenses","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffranciscop%2Fcheck-licenses/lists"}