Security News
Node.js EOL Versions CVE Dubbed the "Worst CVE of the Year" by Security Experts
Critics call the Node.js EOL CVE a misuse of the system, sparking debate over CVE standards and the growing noise in vulnerability databases.
validate-npm-package-license
Advanced tools
Give me a string and I'll tell you if it's a valid npm package license string
The validate-npm-package-license package is used to validate and parse license identifiers based on the SPDX license list. It helps ensure that package licenses are valid and SPDX-compliant, which is important for legal compliance and software distribution.
License Validation
This feature allows you to validate a string to check if it's a valid SPDX license expression. The code sample demonstrates how to validate the 'MIT' license identifier.
"use strict";\nconst validate = require('validate-npm-package-license');\nconst result = validate('MIT');\nconsole.log(result);
License Parsing
This feature enables parsing of complex SPDX license expressions, such as dual licenses. The code sample shows how to parse and validate a compound license expression that includes both 'MIT' and 'Apache-2.0' licenses.
"use strict";\nconst validate = require('validate-npm-package-license');\nconst result = validate('(MIT OR Apache-2.0)');\nconsole.log(result);
The spdx-correct package is designed to help correct invalid SPDX license IDs to their nearest valid identifiers. It is similar to validate-npm-package-license in that it deals with SPDX licenses, but it focuses more on correcting typos and common mistakes rather than validation.
This package provides functionality to parse SPDX license expressions, similar to one of the features of validate-npm-package-license. However, spdx-expression-parse focuses solely on parsing and does not include validation against the SPDX license list.
Give me a string and I'll tell you if it's a valid npm package license string.
var valid = require('validate-npm-package-license');
SPDX license identifiers are valid license strings:
var assert = require('assert');
var validSPDXExpression = {
validForNewPackages: true,
validForOldPackages: true,
spdx: true
};
assert.deepEqual(valid('MIT'), validSPDXExpression);
assert.deepEqual(valid('BSD-2-Clause'), validSPDXExpression);
assert.deepEqual(valid('Apache-2.0'), validSPDXExpression);
assert.deepEqual(valid('ISC'), validSPDXExpression);
The function will return a warning and suggestion for nearly-correct license identifiers:
assert.deepEqual(
valid('Apache 2.0'),
{
validForOldPackages: false,
validForNewPackages: false,
warnings: [
'license should be ' +
'a valid SPDX license expression (without "LicenseRef"), ' +
'"UNLICENSED", or ' +
'"SEE LICENSE IN <filename>"',
'license is similar to the valid expression "Apache-2.0"'
]
}
);
SPDX expressions are valid, too ...
// Simple SPDX license expression for dual licensing
assert.deepEqual(
valid('(GPL-3.0-only OR BSD-2-Clause)'),
validSPDXExpression
);
... except if they contain LicenseRef
:
var warningAboutLicenseRef = {
validForOldPackages: false,
validForNewPackages: false,
spdx: true,
warnings: [
'license should be ' +
'a valid SPDX license expression (without "LicenseRef"), ' +
'"UNLICENSED", or ' +
'"SEE LICENSE IN <filename>"',
]
};
assert.deepEqual(
valid('LicenseRef-Made-Up'),
warningAboutLicenseRef
);
assert.deepEqual(
valid('(MIT OR LicenseRef-Made-Up)'),
warningAboutLicenseRef
);
If you can't describe your licensing terms with standardized SPDX identifiers, put the terms in a file in the package and point users there:
assert.deepEqual(
valid('SEE LICENSE IN LICENSE.txt'),
{
validForNewPackages: true,
validForOldPackages: true,
inFile: 'LICENSE.txt'
}
);
assert.deepEqual(
valid('SEE LICENSE IN license.md'),
{
validForNewPackages: true,
validForOldPackages: true,
inFile: 'license.md'
}
);
If there aren't any licensing terms, use UNLICENSED
:
var unlicensed = {
validForNewPackages: true,
validForOldPackages: true,
unlicensed: true
};
assert.deepEqual(valid('UNLICENSED'), unlicensed);
assert.deepEqual(valid('UNLICENCED'), unlicensed);
FAQs
Give me a string and I'll tell you if it's a valid npm package license string
The npm package validate-npm-package-license receives a total of 18,650,182 weekly downloads. As such, validate-npm-package-license popularity was classified as popular.
We found that validate-npm-package-license demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Critics call the Node.js EOL CVE a misuse of the system, sparking debate over CVE standards and the growing noise in vulnerability databases.
Security News
cURL and Go security teams are publicly rejecting CVSS as flawed for assessing vulnerabilities and are calling for more accurate, context-aware approaches.
Security News
Bun 1.2 enhances its JavaScript runtime with 90% Node.js compatibility, built-in S3 and Postgres support, HTML Imports, and faster, cloud-first performance.