License field and LICENSE file present
Why it matters
Without a LICENSE field and LICENSE file, your package defaults to exclusive copyright — consumers who install it are technically violating copyright law even for internal use. Enterprise legal teams routinely reject dependencies with no license declaration. SPDX license expressions enable automated license scanning in CI pipelines (SSDF PO.1.2). A package without a clear SPDX identifier won't pass compliance checks at many organizations, meaning your package gets blocked regardless of its technical quality.
Severity rationale
Medium because missing license data triggers automated blocking by enterprise compliance scanners and exposes users to legal risk, though the package still functions technically.
Remediation
Add an SPDX license field to package.json and create a LICENSE file in the project root.
{ "license": "MIT" }
Create LICENSE at the repo root with the full license text. For MIT:
MIT License
Copyright (c) 2026 Your Name
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction...
Use https://choosealicense.com to select the right license. Ensure the license field in package.json matches the LICENSE file exactly — mismatches create legal ambiguity.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the SDK / Package Quality Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- spdx · license-expression — SPDX license expression in package metadata
- ssdf:800-218 · PO.1.2 — Establish and maintain criteria for software security checks, including licensing
Taxons
History
- 2026-04-18·v1.0.0·Initial import from sdk-package-quality·automated