License inventory is documented

MIT, Apache-2.0, and BSD licenses all carry attribution requirements: you must preserve copyright notices and license texts when distributing the software. Without a license inventory, you cannot verify that you are meeting these obligations, and during any commercial transaction — acquisition, enterprise sales with contractual IP representations, or legal due diligence — the absence of a license inventory is a red flag that slows or blocks the deal. SSDF PW.4 treats third-party component tracking as a requirement, not a nice-to-have. A license inventory is also the prerequisite for any copyleft or conflict check to be meaningful: you cannot evaluate what you have not enumerated.

Generate and commit a license inventory file. Add a generation script to package.json so it stays current on every build:

npx license-checker --production --out LICENSES.txt --customPath '{name},{licenses},{repository}'

Or automate it in CI:

// package.json
"scripts": {
  "licenses": "license-checker --production --out LICENSES.txt"
}

Commit the generated LICENSES.txt and add a CI step that fails if the file is out of date.