No packages with unknown or missing licenses

In most jurisdictions, software without a license is implicitly 'all rights reserved' — you have no legal permission to use it, even if it is freely distributed on npm. A production dependency with an absent, UNLICENSED, or unrecognizable license field exposes you to IP claims from the original author at any time. CWE-1357 applies because you are relying on a component whose terms of use cannot be verified. Unlike the copyleft check, unknown licenses represent legal uncertainty in all directions: you do not know whether commercial use is permitted, whether redistribution triggers obligations, or whether the author intends to change the terms. This risk is amplified when AI tools generate npm install commands for packages they may have hallucinated.

Audit all production dependencies for license fields:

npx license-checker --production --onlyAllow 'MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;0BSD'

For any package flagged as UNLICENSED or UNKNOWN:

1. Check the GitHub repository for a LICENSE file not included in the npm publish.
2. Contact the maintainer to request license clarification.
3. If no response, replace the package with a licensed alternative.

Do not ship to production with UNLICENSED code in your dependency graph.