dsh-license-guard

A typical Node.js project silently pulls in hundreds of transitive dependencies, each carrying a different license. Shipping an npm package or delivering an enterprise build can turn dangerous the moment a copyleft license slips in unnoticed. Manually paging through every package.json is slow and error-prone, which is exactly the gap dsh-license-guard fills.

Its approach is straightforward: it scans the license or licenses field of every package under node_modules, normalizes the values into SPDX identifiers, then buckets them into five categories — permissive, weak-copyleft, strong-copyleft, unknown, and unlicensed. The built-in policy allows MIT, Apache-2.0, ISC and other permissive terms by default while automatically blocking GPL-3.0, AGPL-3.0, SSPL-1.0 and similar strong-copyleft licenses. Unknown or unlicensed entries count as violations out of the box, though you can relax that with the includeUnknown flag. The license_check tool also accepts a custom allow or deny list and reports exactly which dependencies are in breach, making it easy to wire into a CI gate before every publish.

It is aimed at solo developers, open-source maintainers, and front-end teams who need a fast compliance snapshot before release. The entire pipeline runs locally in plain Node with zero network calls and no external service dependency, so it drops straight into offline environments and CI pipelines. One caveat: this is a heuristic screening tool, not legal advice — for commercial distribution or formal legal sign-off, a qualified attorney review is still the authoritative last step.