{
  "question": "How do I check the licenses of all my npm dependencies before shipping?",
  "slug": "how-to-check-licenses-of-all-npm-dependencies-before-shipping",
  "url": "https://www.rightshold.com/answers/how-to-check-licenses-of-all-npm-dependencies-before-shipping",
  "short_answer": "Generate the full list of packages you ship, including transitive ones, group it by license, and look closely at anything copyleft (GPL, AGPL, LGPL), non-commercial, source-available, unknown or missing. npm 10 can write that list for you with npm sbom; each package's declared license is in its package.json. Permissive licenses (MIT, ISC, BSD, Apache-2.0) only ask you to keep their notices, while a package with no license grants you no permission at all.",
  "checklist": [
    "Install from the lockfile (npm ci) so you check exactly what you ship.",
    "List production packages with their licenses: npm sbom --sbom-format spdx --omit dev > sbom.spdx.json (or npm ls --all --omit dev for the tree).",
    "Group by license and flag: GPL, AGPL and LGPL; CC BY-NC and other non-commercial terms; BUSL, Elastic and SSPL; UNLICENSED, \"SEE LICENSE IN\" and missing licenses.",
    "Read SPDX expressions carefully: \"MIT OR Apache-2.0\" lets you choose one; \"MIT AND CC-BY-4.0\" means both apply.",
    "Open the LICENSE file of every flagged package: declared metadata can be wrong or differ from the file.",
    "Check what your bundler actually pulls into the shipped output; a package listed as a dev dependency can still end up in it.",
    "Collect the notices permissive licenses require into a third-party notices file, and re-run the check in CI whenever the lockfile changes."
  ],
  "sections": [],
  "checks": [
    {
      "label": "An MIT package shipped in an app you sell",
      "license": "MIT",
      "license_name": "MIT License",
      "intended_use": {
        "commercial_use": true,
        "redistribution": true
      },
      "verdict": "permitted",
      "answer": "Yes",
      "findings": [
        "Every use you described is granted by MIT, and nothing you described is prohibited."
      ],
      "duties": [
        "attribution",
        "license_notice"
      ],
      "official_text": "https://opensource.org/license/mit"
    },
    {
      "label": "An LGPL-3.0 package shipped in an app you sell",
      "license": "LGPL-3.0-only",
      "license_name": "GNU Lesser General Public License v3.0",
      "intended_use": {
        "commercial_use": true,
        "redistribution": true
      },
      "verdict": "permitted",
      "answer": "Yes",
      "findings": [
        "Every use you described is granted by LGPL 3.0, and nothing you described is prohibited."
      ],
      "duties": [
        "attribution",
        "license_notice",
        "share_alike",
        "source_disclosure"
      ],
      "official_text": "https://www.gnu.org/licenses/lgpl-3.0.html"
    },
    {
      "label": "A GPL-3.0 package, modified and shipped in an app you sell",
      "license": "GPL-3.0-only",
      "license_name": "GNU General Public License v3.0",
      "intended_use": {
        "commercial_use": true,
        "modification": true,
        "redistribution": true
      },
      "verdict": "permitted",
      "answer": "Yes",
      "findings": [
        "Every use you described is granted by GPL 3.0, and nothing you described is prohibited."
      ],
      "duties": [
        "attribution",
        "license_notice",
        "state_changes",
        "share_alike",
        "source_disclosure"
      ],
      "official_text": "https://www.gnu.org/licenses/gpl-3.0.html"
    }
  ],
  "checks_note": "Yes means the license grants the use, on the duties listed. Duties such as source_disclosure, share_alike and network_source_offer are the ones that conflict with keeping a product closed-source.",
  "ask_rightshold": {
    "start": "https://www.rightshold.com/start?ref=seo",
    "mcp_endpoint": "https://www.rightshold.com/mcp",
    "ask": "Is every npm package in this project OK for a commercial app?",
    "mcp_call": {
      "tool": "check_rights_batch",
      "arguments": {
        "intended_use": {
          "commercial_use": true,
          "redistribution": true
        },
        "items": [
          {
            "ref": "react",
            "license": "MIT"
          },
          {
            "ref": "some-lgpl-lib",
            "license": "LGPL-3.0-only"
          }
        ]
      }
    },
    "also": [
      "No editor? Run curl -fsSL https://www.rightshold.com/check.mjs | node - in your project folder. It checks the direct dependencies in package.json and sends only license ids, never your code or file names.",
      "license_compatibility checks whether the licenses can be combined in one product and which duties apply together."
    ]
  },
  "sources": [
    {
      "title": "npm sbom",
      "url": "https://docs.npmjs.com/cli/v10/commands/npm-sbom"
    },
    {
      "title": "npm ls",
      "url": "https://docs.npmjs.com/cli/v10/commands/npm-ls"
    },
    {
      "title": "package.json license field",
      "url": "https://docs.npmjs.com/cli/v10/configuring-npm/package-json#license"
    },
    {
      "title": "SPDX license expressions",
      "url": "https://spdx.github.io/spdx-spec/v2.3/SPDX-license-expressions/"
    }
  ],
  "related": [
    {
      "title": "How do I check the license of one npm or PyPI package?",
      "url": "https://www.rightshold.com/answers/how-to-check-an-npm-or-pypi-package-license"
    },
    {
      "title": "Can I use an npm package in a commercial product?",
      "url": "https://www.rightshold.com/answers/can-i-use-an-npm-package-in-a-commercial-product"
    },
    {
      "title": "MIT, GPL or AGPL code in a closed-source SaaS",
      "url": "https://www.rightshold.com/answers/can-i-use-mit-gpl-or-agpl-code-in-a-closed-source-saas"
    }
  ],
  "computed_from": "Curated guidance; license verdicts computed from Rightshold's license profiles at render time. Not legal advice.",
  "updated": "2026-10-28"
}