New Research: Supply Chain Attack on Axios Pulls Malicious Dependency from npm.Details
Socket
Book a DemoSign in
Socket

spdx-license-list

Package Overview
Dependencies
Maintainers
1
Versions
21
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

spdx-license-list

List of SPDX licenses

latest
Source
npmnpm
Version
6.11.0
Version published
Weekly downloads
428K
-15.44%
Maintainers
1
Weekly downloads
 
Created
Source

spdx-license-list

List of SPDX licenses

The lists of licenses are just JSON files and can be used anywhere.

  • spdx.json contains just license metadata
  • spdx-full.json includes the license text too
  • spdx-simple.json only contains the license IDs

Using SPDX License List version 3.27.0 (2025-07-01)

Install

npm install spdx-license-list

Usage

const spdxLicenseList = require('spdx-license-list');

console.log(spdxLicenseList.MIT);
/*
{
	name: 'MIT License',
	url: 'http://www.opensource.org/licenses/MIT',
	osiApproved: true
}
*/
const mitLicense = require('spdx-license-list/licenses/MIT');

console.log(mitLicense.licenseText);
//=> 'MIT License\r\n\r\nCopyright (c) <year> <copyright holders> …'

You can also get a version with the licence text included:

const spdxLicenseList = require('spdx-license-list/full');

console.log(spdxLicenseList.MIT);
/*
{
	name: 'MIT License',
	url: 'http://www.opensource.org/licenses/MIT',
	osiApproved: true,
	licenseText: '…'
}
*/

Or just the license IDs as a Set:

const spdxLicenseList = require('spdx-license-list/simple');

console.log(spdxLicenseList);
//=> Set {'Glide', 'Abstyles', …}

API

spdxLicenseList

Type: object

The licenses are indexed by their identifier and contains a name property with the full name of the license, url with the URL to the license, and osiApproved boolean for whether the license is OSI Approved.

Keywords

spdx

FAQs

Package last updated on 14 Jan 2026

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts