# Can I use an npm package in a commercial product?

**Short answer:** A package declaring MIT, shipped in your product: Yes. A package declaring ISC: Yes. A package declaring GPL-3.0, distributed: Yes.

It depends on the license the package declares; MIT, ISC and Apache-2.0 are the most common on npm. Pass the package URL as source_url and Rightshold reads its declared license.

## A package declaring MIT, shipped in your product — Yes

License: [MIT License](https://opensource.org/license/mit) (`MIT`, curated)

- Every use you described is granted by MIT, and nothing you described is prohibited.

Duties: attribution, license_notice
## A package declaring ISC — Yes

License: [ISC License](https://opensource.org/license/isc-license-txt) (`ISC`, curated)

- Every use you described is granted by ISC, and nothing you described is prohibited.

Duties: attribution, license_notice
## A package declaring GPL-3.0, distributed — Yes

License: [GNU General Public License v3.0](https://www.gnu.org/licenses/gpl-3.0.html) (`GPL-3.0-only`, curated)

- Every use you described is granted by GPL 3.0, and nothing you described is prohibited.

Duties: attribution, license_notice, state_changes, share_alike, source_disclosure

## Context
- A package with no declared license grants nothing: no license found is not permission.
- Check transitive dependencies too; the strictest license in the tree sets the duties.

## Sources
- [npm package.json license field](https://docs.npmjs.com/cli/v10/configuring-npm/package-json#license)

## Check it yourself (free, no key)
```json
{
  "tool": "check_license",
  "arguments": {
    "license": "MIT",
    "intended_use": {
      "commercial_use": true,
      "redistribution": true
    }
  }
}
```
REST: POST https://www.rightshold.com/v1/licenses/check

_Computed from Rightshold's license profiles; not legal advice. Updated 2026-10-19. JSON: https://www.rightshold.com/answers/can-i-use-an-npm-package-in-a-commercial-product.json_