{
  "question": "Can I use an npm package in a commercial product?",
  "slug": "can-i-use-an-npm-package-in-a-commercial-product",
  "url": "https://www.rightshold.com/answers/can-i-use-an-npm-package-in-a-commercial-product",
  "short_answer": "A package declaring MIT, shipped in your product: Yes. A package declaring ISC: Yes. A package declaring GPL-3.0, distributed: Yes.",
  "framing": "It depends on the license the package declares; MIT, ISC and Apache-2.0 are the most common on npm. Pass the package URL as source_url and Rightshold reads its declared license.",
  "checks": [
    {
      "label": "A package declaring MIT, shipped in your product",
      "license": "MIT",
      "license_name": "MIT License",
      "intended_use": {
        "commercial_use": true,
        "redistribution": true
      },
      "verdict": "permitted",
      "answer": "Yes",
      "findings": [
        "Every use you described is granted by MIT, and nothing you described is prohibited."
      ],
      "duties": [
        "attribution",
        "license_notice"
      ],
      "curation": "curated",
      "official_text": "https://opensource.org/license/mit"
    },
    {
      "label": "A package declaring ISC",
      "license": "ISC",
      "license_name": "ISC License",
      "intended_use": {
        "commercial_use": true,
        "redistribution": true
      },
      "verdict": "permitted",
      "answer": "Yes",
      "findings": [
        "Every use you described is granted by ISC, and nothing you described is prohibited."
      ],
      "duties": [
        "attribution",
        "license_notice"
      ],
      "curation": "curated",
      "official_text": "https://opensource.org/license/isc-license-txt"
    },
    {
      "label": "A package declaring GPL-3.0, distributed",
      "license": "GPL-3.0-only",
      "license_name": "GNU General Public License v3.0",
      "intended_use": {
        "commercial_use": true,
        "redistribution": true
      },
      "verdict": "permitted",
      "answer": "Yes",
      "findings": [
        "Every use you described is granted by GPL 3.0, and nothing you described is prohibited."
      ],
      "duties": [
        "attribution",
        "license_notice",
        "state_changes",
        "share_alike",
        "source_disclosure"
      ],
      "curation": "curated",
      "official_text": "https://www.gnu.org/licenses/gpl-3.0.html"
    }
  ],
  "context": [
    "A package with no declared license grants nothing: no license found is not permission.",
    "Check transitive dependencies too; the strictest license in the tree sets the duties."
  ],
  "sources": [
    {
      "title": "npm package.json license field",
      "url": "https://docs.npmjs.com/cli/v10/configuring-npm/package-json#license"
    }
  ],
  "check_it_yourself": {
    "mcp": {
      "tool": "check_license",
      "arguments": {
        "license": "MIT",
        "intended_use": {
          "commercial_use": true,
          "redistribution": true
        }
      }
    },
    "rest": "POST https://www.rightshold.com/v1/licenses/check"
  },
  "computed_from": "Rightshold license profiles at render time; not legal advice",
  "updated": "2026-10-19"
}