Gathering detailed insights and metrics for npm-license-generator
Gathering detailed insights and metrics for npm-license-generator
Generate a file with license text from NPM dependencies
Installations
npm install npm-license-generatorDeveloper Guide
BETA
Typescript
No
Module System
ESM
Node Version
20.15.0
NPM Version
10.7.0
Score
61.4
Supply Chain
84.9
Quality
74.6
Maintenance
100
Vulnerability
88
License
Releases
4
Languages
3
TypeScript
HTML
JavaScript
TypeScript (84.95%)
HTML (13.03%)
JavaScript (2.02%)
Developer
mymindstorm
Download Statistics
Total Downloads
0
Last Day
0
Last Week
0
Last Month
0
Last Year
0
GitHub Statistics
MIT License
13 Stars
57 Commits
8 Forks
1 Watchers
3 Branches
2 Contributors
Updated on Mar 16, 2025
Maintainers
1
Package Meta Information
Latest Version
2.0.0
Package Id
npm-license-generator@2.0.0
Unpacked Size
39.78 kB
Size
9.89 kB
File Count
10
NPM Version
10.7.0
Node Version
20.15.0
Published on
Sep 15, 2024
Total Downloads
Cumulative downloads
Total Downloads
NaN
Last Day
0%
NaN
Compared to previous day
Last Week
0%
NaN
Compared to previous week
Last Month
0%
NaN
Compared to previous month
Last Year
0%
NaN
Compared to previous year
Weekly Downloads
Monthly Downloads
Yearly Downloads
NPM License Generator
Generate a page with a copy of NPM dependency licenses. Example output
Usage
Install:
1npm install --global npm-license-generator
Options:
1$ npm-license-generator --help 2 3Usage: 4 npm-license-generator [folder] 5 6Positionals: 7 folder Folder of NPM project. Defaults to current working directory [string] 8 9Options: 10 --version Show version number [boolean] 11 --help Show help [boolean] 12 --out-path HTML output path [string] [default: "./licenses.html"] 13 --registry URL of package registry to use 14 [string] [default: "https://registry.npmjs.org"] 15 --tmp-folder-name Name of temporary folder 16 [string] [default: ".license-gen-tmp"] 17 --template Path to custom mustache template [string] 18 --no-group Do not group licenses [boolean] [default: false] 19 --package-lock Run on all packages listed in package-lock.json 20 [boolean] [default: false] 21 --no-spdx Do not download license file based on SPDX string 22 [boolean] [default: false] 23 --only-spdx Do not download tarballs, only use SPDX string 24 [boolean] [default: false] 25 --error-missing Exit 1 if no license is present for a package 26 [boolean] [default: false]
Use your own template
Supply your own template using the --template option. Templates are written in Mustache. Your template does not have to be HTML, change the output file name using --out-path.
By default, Mustache is given two variables:
name: the package namerenderLicenses: an array of GroupedLicense. When using--no-group, an array of LicenseInfo is passed instead.
Check the lib folder for example templates.
How licenses are found
- Get package version and tarball location from package.lock
- Look for licenses in node_modules if avalible
- Otherwise download tarball, extract, look for licenses, and use that
- Otherwise, evaluate SPDX string and use a file from https://github.com/spdx/license-list-data/tree/master/text
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
4 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-7q7g-4xm8-89cq
- Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-75v8-2h7p-7m2m
Reason
dependency not pinned by hash detected -- score normalized to 2
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/mymindstorm/npm-license-generator/main.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/mymindstorm/npm-license-generator/main.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/mymindstorm/npm-license-generator/main.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/mymindstorm/npm-license-generator/main.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/mymindstorm/npm-license-generator/main.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/mymindstorm/npm-license-generator/main.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/npm.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/mymindstorm/npm-license-generator/npm.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/npm.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/mymindstorm/npm-license-generator/npm.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/npm.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/mymindstorm/npm-license-generator/npm.yml/master?enable=pin
- Info: 0 out of 9 GitHub-owned GitHubAction dependencies pinned
- Info: 3 out of 3 npmCommand dependencies pinned
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
Found 1/11 approved changesets -- score normalized to 0
Reason
0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
security policy file not detected
Details
- Warn: no security policy file detected
- Warn: no security file to analyze
- Warn: no security file to analyze
- Warn: no security file to analyze
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/main.yml:1
- Warn: no topLevel permission defined: .github/workflows/npm.yml:1
- Info: no jobLevel write permissions found
Reason
branch protection not enabled on development/release branches
Details
- Warn: branch protection not enabled for branch 'master'
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 20 are checked with a SAST tool
Score
3.2
/10
Last Scanned on 2025-07-07
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More