Can I use an npm package in a commercial product?
Last updated
TL;DR: A package declaring MIT, shipped in your product: Yes. A package declaring ISC: Yes. A package declaring GPL-3.0, distributed: Yes. It depends on the license the package declares; MIT, ISC and Apache-2.0 are the most common on npm. Pass the package URL as source_url and a2ally reads its declared license.
Is a package declaring MIT, shipped in your product allowed under MIT License?
Yes. Every use you described is granted by MIT, and nothing you described is prohibited.
License: MIT License (MIT, curated)
Duties: attribution, license_notice
Is a package declaring ISC allowed under ISC License?
Yes. Every use you described is granted by ISC, and nothing you described is prohibited.
License: ISC License (ISC, curated)
Duties: attribution, license_notice
Is a package declaring GPL-3.0, distributed allowed under GNU General Public License v3.0?
Yes. Every use you described is granted by GPL 3.0, and nothing you described is prohibited.
License: GNU General Public License v3.0 (GPL-3.0-only, curated)
Duties: attribution, license_notice, state_changes, share_alike, source_disclosure
What else should I know?
- A package with no declared license grants nothing: no license found is not permission.
- Check transitive dependencies too; the strictest license in the tree sets the duties.
What are the sources?
How can I check it myself (free, no key)?
{
"tool": "check_license",
"arguments": {
"license": "MIT",
"intended_use": {
"commercial_use": true,
"redistribution": true
}
}
}Computed from a2ally's license profiles; not legal advice. JSON · Markdown
Get a free API key in one call
No card and no email needed. 100 free credits; the license and policy checks stay free without a key.
curl -s -X POST https://www.a2ally.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export A2ALLY_API_KEY=rs_... # the api_key from the reply (shown once)
curl -s https://www.a2ally.com/v1/licenses/check -H "Authorization: Bearer $A2ALLY_API_KEY" \
-H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'