
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
remark-license
Advanced tools
remark plugin to generate a license section.
This package is a unified (remark) plugin to generate a license section such as the one below.
unified is a project that transforms content with abstract syntax trees (ASTs). remark adds support for markdown to unified. mdast is the markdown AST that remark uses. This is a remark plugin that transforms mdast.
This project is useful when you’re writing documentation for an open source
project, typically a Node.js package, that has one or more readmes and maybe
some other markdown files as well.
You want to show the author and license associated with the project.
When this plugin is used, authors can add a certain heading (say, ## License)
to documents and this plugin will populate them.
This package is ESM only. In Node.js (version 12.20+, 14.14+, or 16.0+), install with npm:
npm install remark-license
In Deno with Skypack:
import remarkLicense from 'https://cdn.skypack.dev/remark-license@6?dts'
In browsers with Skypack:
<script type="module">
import remarkLicense from 'https://cdn.skypack.dev/remark-license@6?min'
</script>
Say we have the following file example.md in this project:
# Example
Some text.
## Use
## API
## License
And our module example.js looks as follows:
import {read} from 'to-vfile'
import {remark} from 'remark'
import remarkLicense from 'remark-license'
main()
async function main() {
const file = await remark()
.use(remarkLicense)
.process(await read('example.md'))
console.log(String(file))
}
Now running node example.js yields:
# Example
Some text.
## Use
## API
## License
[MIT](license) © [Titus Wormer](https://wooorm.com)
👉 Note: This info is inferred from this project’s
package.jsonandlicensefile. Running this example in a different package will yield different results.
This package exports no identifiers.
The default export is remarkLicense.
unified().use(remarkLicense[, options])Generate a license section. In short, this plugin:
/^licen[cs]e$/i or options.heading.optionsConfiguration (optional in Node.js, required in browsers).
options.nameLicense holder (string).
In Node.js, defaults to the author field in the closest package.json.
Throws when neither given nor detected.
options.licenseSPDX identifier (string).
In Node.js, defaults to the license field in the closest package.json.
Throws when neither given nor detected.
options.fileFile name of license file (string, optional).
In Node.js, defaults to a file in the directory of the closest package.json
that matches /^licen[cs]e(?=$|\.)/i.
If there is no given or found license file, but options.license is a known
SPDX identifier, then the URL to the license on spdx.org is used.
options.urlURL to license holder (string, optional).
In Node.js, defaults to the author field in the closest package.json.
http:// is prepended if url does not start with an HTTP or HTTPS protocol.
options.ignoreFinalDefinitionsIgnore definitions that would otherwise trail in the section (boolean,
default: true).
options.headingHeading to look for (string (case insensitive) or RegExp, default:
/^licen[cs]e$/i).
This package is fully typed with TypeScript.
It exports an Options type, which specifies the interface of the accepted
options.
Projects maintained by the unified collective are compatible with all maintained versions of Node.js. As of now, that is Node.js 12.20+, 14.14+, and 16.0+. Our projects sometimes work with older versions, but this is not guaranteed.
This plugin works with unified version 6+ and remark version 7+.
options.url (or author.url in package.json) is used and injected into the
tree when it’s given or found.
This could open you up to a cross-site scripting (XSS) attack if you pass
user provided content in or store user provided content in package.json.
This may become a problem if the markdown is later transformed to rehype (hast) or opened in an unsafe markdown viewer.
remark-collapse
– make some sections collapsibleremark-contributors
– generate a contributors sectionremark-toc
— generate a table of contentsremark-usage
— generate a usage exampleSee contributing.md in remarkjs/.github for ways
to get started.
See support.md for ways to get help.
This project has a code of conduct. By interacting with this repository, organization, or community you agree to abide by its terms.
FAQs
remark plugin to generate a license section
The npm package remark-license receives a total of 549 weekly downloads. As such, remark-license popularity was classified as not popular.
We found that remark-license demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.