
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@knime/licenses
Advanced tools
@knime/licensesInternal utility functions checking all dependencies for allowed licenses and reporting disallowed ones.
It exposes a command line tool license-check which can be used as npm or npx run script in an importing package.
The options you can pass to the tool are documented below and can also be viewed by passing the --help option.
Options: -V, --version output the version number -c, --check-only Check for valid licenses and report not allowed ones -s, --summary Print a summary of all used licenses -o, --output Location of the output file to be created, relative to the calling project root -f, --config Optional project-specific license config path, relative to the calling project root -h, --help display help for command
In addition to the default config shipped with @knime/licenses, you can provide project-specific settings.
By default, license-check automatically looks for one of these files in the calling project root (process.cwd()):
license.config.jslicense.config.mjslicense.config.cjslicense.config.jsonYou can also explicitly set a config file path with --config.
If no project config file is found, or the configured file path does not exist, the tool falls back to the default @knime/licenses configuration.
The project config must match the default config structure (onlyAllow, excludePackages, manualPackages) and is merged with the built-in defaults:
onlyAllow: concatenated and de-duplicatedexcludePackages: concatenated and de-duplicatedmanualPackages: concatenated and de-duplicated by full object contentFAQs
License checker and open source attribution collector
The npm package @knime/licenses receives a total of 1,251 weekly downloads. As such, @knime/licenses popularity was classified as popular.
We found that @knime/licenses demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.