Guide · npm

npm license checker — audit every dependency’s license, no install

Here’s how to check the license of every npm dependency — direct and transitive — straight from your lockfile, with no npm install, no node_modules, and nothing sent to a SaaS. It runs as a GitHub Action or a single container, on your own infrastructure, in about five minutes.

Updated 24 Jul 2026 · by the depproof team

Why the usual npm license tools make you install first

Most npm license tools work off an installed node_modules/, so you have to run a full npm install first — slow in CI, awkward in a locked-down network, and impossible when you only have the source and can’t install it. SaaS scanners skip the install but want your code in their cloud instead.

depproof does neither: it reads your lockfile, so you get the license picture without installing anything and without your code leaving your infrastructure.

Option 1 · GitHub Action

Add this to a workflow. depproof reads your lockfile and uploads an HTML license report and a CycloneDX SBOM as build artifacts — no npm install in the job.

# .github/workflows/licenses.yml
name: licenses
on: [push]

jobs:
  licenses:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: depproof/depproof-action@v1
        with:
          fail-on: none  # report-only; license CI gating is on the roadmap

Option 2 · Docker container

The same scanner ships as one public image — run it in any CI, or locally. Point it at a checkout, or straight at a single lockfile.

docker pull ghcr.io/depproof/depproof:v0

# audit licenses for the current npm project — no install
docker run --rm -v $PWD:/work -w /work ghcr.io/depproof/depproof:v0 \
  scan --discover --root /work --fail-on none --html --output-dir /work

What you get

Every dependency, direct and transitive — the whole tree, not just what’s in your package.json.
A clear license for each one, named consistently and classified allowed, review, or forbidden.
Dev and production dependencies told apart, so you can hold what you ship to a stricter bar.
An HTML report you can read and a CycloneDX SBOM — the machine-readable artifact auditors and customers ask for.

Reading the license report

depproof classifies each license as allowed, review, or forbidden, so a copyleft or unknown license stands out in the report — and whether a copyleft finding like AGPL is actually a problem (is AGPL safe for commercial and SaaS use?) depends on how you use it. Today this is report-only for licenses — you review the findings; CI gating on a license policy is on the roadmap. To fail a build today, depproof gates on vulnerability severity (fail-on: critical | high | medium | low | none).

Works with npm, pnpm, and yarn lockfiles. For the most accurate audit, commit your lockfile and scan that — it’s the exact picture of what you ship.

Where this fits

A per-repo license check is the first data point; the moment a customer or auditor asks about your whole estate, you’ll want those results aggregated in the depproof hub. See dependency governance — when per-repo scans stop being enough for the org-wide picture. And if your product also ships Java, the same tool covers it:

Scan npm dependencies for vulnerabilities — the CVE side of the same scan, with a CI severity gate.
Maven license check without building — the JVM equivalent, one tool for both.
Self-hosted SBOM generation — keep the whole process on your own infrastructure, no SaaS.
MIT vs Apache-2.0 — the two licenses most of your allowed list will be, and the one real difference between them.
Open-source license guide — what a flagged license actually means for you (BSL, Elastic, AGPL, and more).

Audit your licenses → Read the docs More guides

depproof is free for open source and teams under $1M revenue — see pricing. The action README is the source of truth for exact inputs and the current release.