Can I use an npm package in a commercial product?

Short answer: A package declaring MIT, shipped in your product: Yes. A package declaring ISC: Yes. A package declaring GPL-3.0, distributed: Yes.

It depends on the license the package declares; MIT, ISC and Apache-2.0 are the most common on npm. Pass the package URL as source_url and Rightshold reads its declared license.

A package declaring MIT, shipped in your product: Yes

License: MIT License (MIT, curated)

• Every use you described is granted by MIT, and nothing you described is prohibited.

Duties: attribution, license_notice

A package declaring ISC: Yes

License: ISC License (ISC, curated)

• Every use you described is granted by ISC, and nothing you described is prohibited.

Duties: attribution, license_notice

A package declaring GPL-3.0, distributed: Yes

License: GNU General Public License v3.0 (GPL-3.0-only, curated)

• Every use you described is granted by GPL 3.0, and nothing you described is prohibited.

Duties: attribution, license_notice, state_changes, share_alike, source_disclosure

Context

• A package with no declared license grants nothing: no license found is not permission.
• Check transitive dependencies too; the strictest license in the tree sets the duties.

Sources

• npm package.json license field

Check it yourself (free, no key)

{
  "tool": "check_license",
  "arguments": {
    "license": "MIT",
    "intended_use": {
      "commercial_use": true,
      "redistribution": true
    }
  }
}

Computed from Rightshold's license profiles; not legal advice. Updated 2026-10-19. JSON · Markdown