Security News
tea.xyz Spam Plagues npm and RubyGems Package Registries
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
Readme
Development on spdx.js has moved to separate, smaller packages.
spdx-expression-parse and spdx-satisfies are direct successors to spdx.js.
You may also be interested in spdx-compare, spdx-correct, and other packages on the npm public registry. kemitchell writes a lot of them.
var spdx = require('spdx')
var assert = require('assert')
assert(spdx.valid('Invalid-Identifier') === null)
assert(spdx.valid('GPL-2.0'))
assert(spdx.valid('GPL-2.0+'))
assert(spdx.valid('LicenseRef-23'))
assert(spdx.valid('LicenseRef-MIT-Style-1'))
assert(spdx.valid('DocumentRef-spdx-tool-1.2:LicenseRef-MIT-Style-2'))
OR
Operatorassert(spdx.valid('(LGPL-2.1 OR MIT)'))
assert(spdx.valid('(LGPL-2.1 OR MIT OR BSD-3-Clause)'))
AND
Operatorassert(spdx.valid('(LGPL-2.1 AND MIT)'))
assert(spdx.valid('(LGPL-2.1 AND MIT AND BSD-2-Clause)'))
WITH
Operatorassert(spdx.valid('(GPL-2.0+ WITH Bison-exception-2.2)'))
assert.deepEqual(
spdx.parse('(LGPL-2.1 OR BSD-3-Clause AND MIT)'),
{ left: { license: 'LGPL-2.1' },
conjunction: 'or',
right: {
left: { license: 'BSD-3-Clause' },
conjunction: 'and',
right: { license: 'MIT' } } })
assert.deepEqual(
spdx.parse('(MIT AND (LGPL-2.1+ AND BSD-3-Clause))'),
{ left: { license: 'MIT' },
conjunction: 'and',
right: {
left: {
license: 'LGPL-2.1',
plus: true },
conjunction: 'and',
right: { license: 'BSD-3-Clause' } } })
assert(!spdx.valid('MIT '))
assert(!spdx.valid(' MIT'))
assert(!spdx.valid('MIT AND BSD-3-Clause'))
assert(Array.isArray(spdx.licenses))
assert(spdx.licenses.indexOf('ISC') > -1)
assert(spdx.licenses.indexOf('Apache-1.7') < 0)
assert(spdx.licenses.every(function(element) {
return typeof element === 'string' }))
assert(Array.isArray(spdx.exceptions))
assert(spdx.exceptions.indexOf('GCC-exception-3.1') > -1)
assert(spdx.exceptions.every(function(element) {
return typeof element === 'string' }))
assert.equal(spdx.specificationVersion, '2.0')
The Software Package Data Exchange (SPDX) specification is the work of the Linux Foundation and its contributors, and is licensed under the terms of the Creative Commons Attribution License 3.0 Unported (SPDX: "CC-BY-3.0"). "SPDX" is a United States federally registered trademark of the Linux Foundation.
FAQs
SPDX License Expression Syntax parser
The npm package spdx receives a total of 25,153 weekly downloads. As such, spdx popularity was classified as popular.
We found that spdx demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
Security News
As cyber threats become more autonomous, AI-powered defenses are crucial for businesses to stay ahead of attackers who can exploit software vulnerabilities at scale.
Security News
UnitedHealth Group disclosed that the ransomware attack on Change Healthcare compromised protected health information for millions in the U.S., with estimated costs to the company expected to reach $1 billion.