Is anything in your node_modules GPL?

Paid scanners such as FOSSA and Snyk answer this inside a platform. This page does the core of it for free: paste your package-lock.json and get every dependency licence, with strong-copyleft, unlicensed, weak-copyleft and unknown packages listed first. SPDX OR/AND expressions are resolved.

Nothing is uploaded. The lockfile you paste is read in this browser and never leaves your device, and this tool makes no network calls of its own. It reads licence metadata that package authors declared; it is not legal advice.

Paste your lockfile

Deny list (optional, comma separated): skip devDependencies

Paste a package-lock.json above and click Check licences.

Want it as a CI gate?

Same logic, zero dependencies, one file plus the shared module. It reads one local file and nothing else:

node license-check.mjs                              # audit ./package-lock.json
node license-check.mjs --deny GPL-3.0-only,AGPL-3.0-only  # exit 1 if any appear
node license-check.mjs --fail-on copyleft --no-dev  # exit 1 on strong copyleft or unlicensed
node license-check.mjs --json                       # machine-readable

Get license-check.mjs and classify.mjs from the repo. Node 18+, nothing to install, no network calls.

Common questions

Which npm licenses are copyleft?

GPL, AGPL, SSPL and similar licences are strong copyleft: shipping code that includes them can oblige you to release your own source under the same terms. LGPL, MPL, EPL and CDDL are weak copyleft, which usually only reach modifications to the library itself. MIT, ISC, BSD and Apache-2.0 are permissive. The report lists every non-permissive package so a person can review it.

How does it handle OR and AND licence expressions?

For an OR expression such as (MIT OR GPL-3.0-only) the tool assumes you may choose, and scores the most permissive branch. For AND it scores the strictest. A WITH exception is scored as the base licence. Check the actual terms for anything you ship.

Does this tool upload my package-lock.json?

No. The lockfile is read in this page and never leaves your device. The page makes no network calls, and the CLI reads one local file.

Why do some packages show no licence?

npm only records a licence in the lockfile when the package declares one in its package.json. A package with none is reported as unknown, which is a prompt to read its repository, not a finding that it is unlicensed. Lockfile version 1 files record no licences at all.

Is this legal advice?

No. This is a heuristic read of licence metadata that package authors typed, which can be wrong or out of date. It is not legal advice and does not replace review by a qualified lawyer before you ship or sell software.

More: an npm licence compliance checklist for shipping software