License Ripper

Searches node_modules for licenses within loosely matched NOTICE, LICENSE/LICENCE, COPYING, and README files to automate most of the license compliance work, resolving package repositories and downloading copies if necessary.

Output should still be checked as it's possible for incomplete or incorrect data to pass through, some alternate package managers such as yarn are not yet supported, and some packages may even be skipped with globally installed packages. When used as a CLI program, it will warn when license text does not appear to match with the license type, or if any license type was resolved using license text instead of package.toml (marked with a * at the end). These warnings can be resolved through the overrides config option to clear up any issues.

Similar tools exist such as license-checker and license-report exist, however the primary purpose of these other tools is to report the license type of other packages and will at most allow you to see where you can access the license.

If you're using webpack, webpack-license-plugin is a more mature library that provides license text and hooks into webpack to resolve only the packages that make it to the final build, useful when there's package licenses you can't comply with (such as GPL/LGPL) that are only used as development tools or server side.

Supported Package Managers

• npm
• pnpm
• yarn classic

CLI

npm install -g license-ripper or npm install -D license-ripper for package local usage with npx.

Usage: license-ripper [OPTIONS] [PROJECT_ROOT]

Options:
  -o, --output <FILE_NAME>   Writes output to a file rather than stdout
      --config <FILE_NAME>   Passes the file as ripAll's options parameter
      --compress             Changes output to recycle license text, replacing the value with an index
      --include-dev          Includes dev dependencies in the output
      --include-homepage     Adds a homepage key containing a URL string for relevant packages
      --include-repository   Adds a repository key containing a URL string for relevant packages
      --include-funding      Adds a funding key containing a list of URL strings for relevant packages
      --include-description  Adds a description key containing containing the description stored in package.json
      --include <NAMES>      Include only packages with a match in NAMES, a comma separated list of package names
      --exclude <NAMES>      Exclude packages matching NAMES, a comma separated list of package names
      --summary              Changes output to count licenses grouped by name
      --clean                Deletes cached licenses instead of resolving licenses
  -v, --version
  -h, --help

Config/Options:

1export type Options = {
2  /** Adds a homepage key containing a URL string for relevant packages, defaults to false */
3  includeHomepage?: boolean;
4  /** Adds a repository key containing a URL string for relevant packages, defaults to false */
5  includeRepository?: boolean;
6  /** Adds a funding key containing a list of URL strings for relevant packages, defaults to false */
7  includeFunding?: boolean;
8  /** Adds a description key containing the description stored in package.json, defaults to false */
9  includeDescription?: boolean;
10  /** Includes devDependencies in the output, defaults to false */
11  includeDev?: boolean;
12  /** List of package names to exclude from results, used when the license is only provided from a parent package */
13  exclude?: string[];
14  /** When defined, any packages not in this list are excluded */
15  include?: string[];
16  /** Useful for getting rid of warnings and handling cases where the tool fails to grab the license */
17  overrides?: {
18    [packageName: string]: {
19      licenseExpression: string;
20      licenses?: ForcedLicense[];
21    };
22  };
23  /** Add anything not picked up by the tool */
24  append?: {
25    name: string;
26    version?: string;
27    path?: string;
28    licenseExpression?: string;
29    licenses?: ForcedLicense[];
30    homepage?: string;
31    repository?: string;
32    funding?: string[];
33    description?: string;
34  }[];
35  /** Defaults to [projectRoot]/node_modules/.cache/license-ripper */
36  cacheFolder?: string;
37};
38
39export type ForcedLicense = {
40  expression?: string;
41  text?: string;
42  file?: string;
43};

Library Usage

1import { ripAll } from "./dist/index.js";
2
3const projectRoot = "";
4const options = { includeRepository: true };
5const results = await ripAll(projectRoot, options);
6
7console.log(JSON.stringify(results.resolved, null, 2));
8// [
9//   {
10//     "name": "array-find-index",
11//     "version": "1.0.2",
12//     "path": "node_modules/array-find-index",
13//     "licenseExpression": "MIT",
14//     "licenses": [
15//       {
16//         "expression": "MIT",
17//         "source": "license",
18//         "text": "The MIT License (MIT) ..."
19//       },
20//       {
21//         "expression": "UNKNOWN",
22//         "source": "readme",
23//         "text": "## License\n\nMIT © [Sindre Sorhus](https://sindresorhus.com)\n"
24//       }
25//     ],
26//     "repository": "https://github.com/sindresorhus/array-find-index"
27//   },
28//   ...
29//