# spdx-expression-parse

> parse SPDX license expressions

Latest version **5.0.0** (published 2026-07-16) · MIT license · 0 weekly downloads

## Install

```sh
npm install spdx-expression-parse
pnpm add spdx-expression-parse
yarn add spdx-expression-parse
bun add spdx-expression-parse
```

## Health

**Score 63/100 (C)** — status: active.

Positive: has types package; no vulnerabilities; recently updated; high maintenance score; high quality score.

Warnings: low downloads; no esm support.

## Facts

| | |
|---|---|
| Version | 5.0.0 |
| Published | 2026-07-16 |
| First published | 2015-08-02 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | separate (@types/spdx-expression-parse) |
| Module format | CommonJS |
| Dependencies | 2 |
| Unpacked size | 12.2 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 45 |
| Author | Kyle E. Mitchell |
| Maintainers | kemitchell, motet-a |
| Keywords | SPDX, law, legal, license, metadata, package, package.json, standards |

## Links

- npm: https://www.npmjs.com/package/spdx-expression-parse
- Repository: https://github.com/jslicense/spdx-expression-parse.js
- Homepage: https://github.com/jslicense/spdx-expression-parse.js#readme
- Issues: https://github.com/jslicense/spdx-expression-parse.js/issues
- npm.io page: https://npm.io/package/spdx-expression-parse

## Dependencies (2)

- [spdx-exceptions](https://npm.io/package/spdx-exceptions.md) ^2.1.0
- [spdx-license-ids](https://npm.io/package/spdx-license-ids.md) ^3.0.0

## Alternatives

- [@mapbox/jsonlint-lines-primitives](https://npm.io/package/@mapbox/jsonlint-lines-primitives.md) — 5.3M weekly downloads
- [reftools](https://npm.io/package/reftools.md) — 3.5M weekly downloads
- [@hey-api/openapi-ts](https://npm.io/package/@hey-api/openapi-ts.md) — 3.5M weekly downloads
- [@mapbox/geojson-rewind](https://npm.io/package/@mapbox/geojson-rewind.md) — 2.4M weekly downloads
- [turbo-stream](https://npm.io/package/turbo-stream.md) — 1.7M weekly downloads

## Recent versions

- 5.0.0 (latest) — 2026-07-16
- 4.0.0 — 2023-11-21
- 3.0.1 — 2020-05-13
- 3.0.0 — 2018-02-27
- 2.0.2 — 2017-07-04
- 2.0.1 — 2017-06-08
- 2.0.0 — 2017-06-07
- 1.0.4 — 2016-10-05
- 1.0.3 — 2016-08-26
- 1.0.2 — 2015-11-24
- 1.0.1 — 2015-11-04
- 1.0.0 — 2015-08-02

## README

This package parses [SPDX license expression](https://spdx.org/spdx-specification-21-web-version#h.jxpfx0ykyb60) strings describing license terms, like [package.json license strings](https://docs.npmjs.com/files/package.json#license), into consistently structured ECMAScript objects.  The npm command-line interface depends on this package, as do many automatic license-audit tools.

In a nutshell:

```javascript
var parse = require('spdx-expression-parse')
var assert = require('assert')

assert.deepEqual(
  // Licensed under the terms of the Two-Clause BSD License.
  parse('BSD-2-Clause'),
  {license: 'BSD-2-Clause'}
)

assert.throws(function () {
  // An invalid SPDX license expression.
  // Should be `Apache-2.0`.
  parse('Apache 2')
})

assert.deepEqual(
  // Dual licensed under either:
  // - LGPL 2.1
  // - a combination of Three-Clause BSD and MIT
  parse('(LGPL-2.1 OR BSD-3-Clause AND MIT)'),
  {
    left: {license: 'LGPL-2.1'},
    conjunction: 'or',
    right: {
      left: {license: 'BSD-3-Clause'},
      conjunction: 'and',
      right: {license: 'MIT'}
    }
  }
)
```

The syntax comes from the [Software Package Data eXchange (SPDX)](https://spdx.org/), a standard from the [Linux Foundation](https://www.linuxfoundation.org) for shareable data about software package license terms.  SPDX aims to make sharing and auditing license data easy, especially for users of open-source software.

The bulk of the SPDX standard describes syntax and semantics of XML metadata files.  This package implements two lightweight, plain-text components of that larger standard:

1.  The [license list](https://spdx.org/licenses), a mapping from specific string identifiers, like `Apache-2.0`, to standard form license texts and bolt-on license exceptions.  The [spdx-license-ids](https://www.npmjs.com/package/spdx-license-ids) and [spdx-exceptions](https://www.npmjs.com/package/spdx-exceptions) packages implement the license list.  `spdx-expression-parse` depends on and `require()`s them.

    Any license identifier from the license list is a valid license expression:

    ```javascript
    var identifiers = []
      .concat(require('spdx-license-ids'))
      .concat(require('spdx-license-ids/deprecated'))
      .filter(function (id) { return id[id.length - 1] !== '+' })

    identifiers.forEach(function (id) {
      assert.deepEqual(parse(id), {license: id})
    })
    ```

    So is any license identifier `WITH` a standardized license exception:

    ```javascript
    identifiers.forEach(function (id) {
      require('spdx-exceptions').forEach(function (e) {
        assert.deepEqual(
          parse(id + ' WITH ' + e),
          {license: id, exception: e}
        )
      })
    })
    ```

2.  The license expression language, for describing simple and complex license terms, like `MIT` for MIT-licensed and `(GPL-2.0 OR Apache-2.0)` for dual-licensing under GPL 2.0 and Apache 2.0.  `spdx-expression-parse` itself implements license expression language, exporting a parser.

    ```javascript
    assert.deepEqual(
      // Licensed under a combination of:
      // - the MIT License AND
      // - a combination of:
      //   - LGPL 2.1 (or a later version) AND
      //   - Three-Clause BSD
      parse('(MIT AND (LGPL-2.1+ AND BSD-3-Clause))'),
      {
        left: {license: 'MIT'},
        conjunction: 'and',
        right: {
          left: {license: 'LGPL-2.1', plus: true},
          conjunction: 'and',
          right: {license: 'BSD-3-Clause'}
        }
      }
    )
    ```

This package differs slightly from the SPDX standard in allowing lower- and mixed-case `AND`, `OR`, and `WITH` operators:

```javascript
assert.deepEqual(
  parse('MIT or BSD-2-Clause'),
  { left: { license: 'MIT' }, conjunction: 'or', right: { license: 'BSD-2-Clause' } }
)
assert.deepEqual(
  parse('GPL-2.0 with GCC-exception-2.0'),
  { license: 'GPL-2.0', exception: 'GCC-exception-2.0' }
)
```

The Linux Foundation and its contributors license the SPDX standard under the terms of [the Creative Commons Attribution License 3.0 Unported (SPDX: "CC-BY-3.0")](http://spdx.org/licenses/CC-BY-3.0).  "SPDX" is a United States federally registered trademark of the Linux Foundation.  The authors of this package license their work under the terms of the MIT License.

---
_Source: https://npm.io/package/spdx-expression-parse · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._