# validate-npm-package-license

> Give me a string and I'll tell you if it's a valid npm package license string

Latest version **3.0.4** (published 2018-08-05) · Apache-2.0 license · 0 weekly downloads

## Install

```sh
npm install validate-npm-package-license
pnpm add validate-npm-package-license
yarn add validate-npm-package-license
bun add validate-npm-package-license
```

## Health

**Score 23/100 (F)** — status: abandoned.

Positive: has types package; no vulnerabilities; high quality score.

Warnings: low downloads; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 3.0.4 |
| Published | 2018-08-05 |
| First published | 2015-05-03 |
| Weekly downloads | 0 |
| License | Apache-2.0 |
| TypeScript types | separate (@types/validate-npm-package-license) |
| Module format | CommonJS |
| Dependencies | 2 |
| Unpacked size | 16.2 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 29 |
| Author | Kyle E. Mitchell |
| Maintainers | kemitchell |
| Keywords | license, npm, package, validation |

## Links

- npm: https://www.npmjs.com/package/validate-npm-package-license
- Repository: https://github.com/kemitchell/validate-npm-package-license.js
- Homepage: https://github.com/kemitchell/validate-npm-package-license.js#readme
- Issues: https://github.com/kemitchell/validate-npm-package-license.js/issues
- npm.io page: https://npm.io/package/validate-npm-package-license

## Dependencies (2)

- [spdx-correct](https://npm.io/package/spdx-correct.md) ^3.0.0
- [spdx-expression-parse](https://npm.io/package/spdx-expression-parse.md) ^3.0.0

## Alternatives

- [@sindresorhus/slugify](https://npm.io/package/@sindresorhus/slugify.md) — 3.7M weekly downloads
- [solid-js](https://npm.io/package/solid-js.md) — 2.7M weekly downloads
- [expo-glass-effect](https://npm.io/package/expo-glass-effect.md) — 2.5M weekly downloads
- [nanoassert](https://npm.io/package/nanoassert.md) — 780.8K weekly downloads
- [@ffmpeg/ffmpeg](https://npm.io/package/@ffmpeg/ffmpeg.md) — 529.5K weekly downloads

## Recent versions

- 3.0.4 (latest) — 2018-08-05
- 3.0.3 — 2018-02-27
- 3.0.2 — 2018-02-27
- 3.0.1 — 2015-08-23
- 3.0.0 — 2015-08-23
- 2.0.0 — 2015-06-19
- 1.0.0 — 2015-06-05
- 1.0.0-prerelease-3 — 2015-06-05
- 1.0.0-prerelease-2 — 2015-05-06
- 1.0.0-prerelease-1 — 2015-05-03

## README

validate-npm-package-license
============================

Give me a string and I'll tell you if it's a valid npm package license string.

```javascript
var valid = require('validate-npm-package-license');
```

SPDX license identifiers are valid license strings:

```javascript

var assert = require('assert');
var validSPDXExpression = {
  validForNewPackages: true,
  validForOldPackages: true,
  spdx: true
};

assert.deepEqual(valid('MIT'), validSPDXExpression);
assert.deepEqual(valid('BSD-2-Clause'), validSPDXExpression);
assert.deepEqual(valid('Apache-2.0'), validSPDXExpression);
assert.deepEqual(valid('ISC'), validSPDXExpression);
```
The function will return a warning and suggestion for nearly-correct license identifiers:

```javascript
assert.deepEqual(
  valid('Apache 2.0'),
  {
    validForOldPackages: false,
    validForNewPackages: false,
    warnings: [
      'license should be ' +
      'a valid SPDX license expression (without "LicenseRef"), ' +
      '"UNLICENSED", or ' +
      '"SEE LICENSE IN <filename>"',
      'license is similar to the valid expression "Apache-2.0"'
    ]
  }
);
```

SPDX expressions are valid, too ...

```javascript
// Simple SPDX license expression for dual licensing
assert.deepEqual(
  valid('(GPL-3.0-only OR BSD-2-Clause)'),
  validSPDXExpression
);
```

... except if they contain `LicenseRef`:

```javascript
var warningAboutLicenseRef = {
  validForOldPackages: false,
  validForNewPackages: false,
  spdx: true,
  warnings: [
    'license should be ' +
    'a valid SPDX license expression (without "LicenseRef"), ' +
    '"UNLICENSED", or ' +
    '"SEE LICENSE IN <filename>"',
  ]
};

assert.deepEqual(
  valid('LicenseRef-Made-Up'),
  warningAboutLicenseRef
);

assert.deepEqual(
  valid('(MIT OR LicenseRef-Made-Up)'),
  warningAboutLicenseRef
);
```

If you can't describe your licensing terms with standardized SPDX identifiers, put the terms in a file in the package and point users there:

```javascript
assert.deepEqual(
  valid('SEE LICENSE IN LICENSE.txt'),
  {
    validForNewPackages: true,
    validForOldPackages: true,
    inFile: 'LICENSE.txt'
  }
);

assert.deepEqual(
  valid('SEE LICENSE IN license.md'),
  {
    validForNewPackages: true,
    validForOldPackages: true,
    inFile: 'license.md'
  }
);
```

If there aren't any licensing terms, use `UNLICENSED`:

```javascript
var unlicensed = {
  validForNewPackages: true,
  validForOldPackages: true,
  unlicensed: true
};
assert.deepEqual(valid('UNLICENSED'), unlicensed);
assert.deepEqual(valid('UNLICENCED'), unlicensed);
```

---
_Source: https://npm.io/package/validate-npm-package-license · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._