Skip to content

JavaScript and TypeScript#

What licenseal reads in an npm project. The rules that hold for every ecosystem are under How a scan works.

  • Registry: npm
  • Manifests: package.json (dependencies, devDependencies, peerDependencies, optionalDependencies)
  • Lockfiles: package-lock.json (v1/v2/v3), pnpm-lock.yaml, yarn.lock, bun.lock

What is read#

  • peerDependencies and optionalDependencies are read as production, like dependencies.
  • A package installed under an npm alias is reported under its real name.
  • A package that another package.json in the tree defines (a monorepo or pnpm workspace member) is not reported; a stderr line says how many were excluded.

Dev dependencies#

devDependencies are dev dependencies.

Off-registry dependencies#

These are reported as off-registry dependencies, in package.json and in every lockfile format:

  • a git URL;
  • a hosting shorthand (github:user/repo, a bare user/repo);
  • a tarball URL;
  • a file: / link: / portal: or bare path (../pkg, C:\pkg, pkg-1.0.0.tgz) the scan does not read.

One exception: a lockfile's resolved tarball URL in the layout registries serve (<host>/<name>/-/<file>.tgz, on any host) is a package of another registry, looked up on registry.npmjs.org.

Not evaluated#

  • engines.
  • overrides, Yarn resolutions, and pnpm overrides in package.json are not read: see What is not read.

See also#