Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A dependable npm license audit starts with a complete, reproducible inventory—not an AI guess. In this reported project, the author used deterministic tools to inventory 1,417 dependency entries, then used Claude Code to investigate the ambiguous cases. Humans reviewed the risk decisions, including an AGPL finding. The counts and outcomes are the author’s account of one project, not independently verified results or a benchmark.
Why audit the full dependency tree?
A project’s direct dependencies are only the top layer. In this case study, the author counted 62 direct dependencies in package.json, while the reported installed dependency tree contained 1,417 entries. Transitive packages brought in by other dependencies can therefore matter to an audit even if the project team never added them directly.
The author’s goal was to identify packages whose license status warranted closer review, determine how they entered the tree, and decide what to do with unresolved or concerning cases. The point is not that every flagged license creates the same legal or operational risk; the point is that a direct-dependency list alone can miss relevant packages.
How the author inventoried and classified packages
Start with machine-readable metadata
The author generated a production dependency license inventory with:
#1 Best Overall
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
npx license-checker-rss --json --production > licenses.jsonThey used jq and Claude Code to summarize counts and flag entries outside the expected license set. The report also mentions npm ls --all --parseable | wc -l as a way the author counted the tree. These commands reflect the reported workflow; package manager behavior, project configuration, and tool output can affect what a particular inventory includes, so validate coverage for your own build and deployment process.
Metadata is a useful first pass, not proof that a package’s license is clear or that its declared identifier resolves every question. npm recommends declaring licensing information in package.json and documents SPDX expressions for common cases, but metadata can be missing, custom, or inconsistent with the license file. See npm’s package.json license documentation.
Use a fixed vocabulary and demand evidence
For the ambiguous remainder, the author instructed Claude Code to use five classifications: PERMISSIVE, WEAK_COPYLEFT, STRONG_COPYLEFT, PROPRIETARY, or CANNOT_DETERMINE. The requested output was one JSON line per package, with its name, version, classification, an exact supporting sentence from the license text, and the file path.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesThe instructions also required the tool to report both package metadata and license-file text when they disagreed, rather than silently choosing one. That distinction matters: a label without a verifiable source is hard to audit, while a quoted passage and path give a reviewer something concrete to check. The author says an earlier attempt had misclassified a package based on the appearance of its README, which is why the final rubric emphasized license text and explicit evidence.
Claude Code’s role in this workflow was to help read, classify, summarize, and trace material—not to make a legal determination. If the evidence did not support a classification, the requested result was CANNOT_DETERMINE. As the author put it, “CANNOT_DETERMINE is a feature.”
What the audit found in this project
The following figures are the author’s reported results for this project; they are not general statistics about npm packages:
Rank #3
| Reported finding | What it represents |
|---|---|
| 1,417 dependency entries | The author’s reported tree count; the metadata inventory had the same count. |
| 62 direct dependencies | The author’s count in package.json, contrasted with the larger transitive tree. |
| 1,361 packages | Entries the author grouped as MIT, ISC, BSD, or Apache-2.0. |
| 19 entries | Packages the author grouped as MPL-2.0 or LGPL. |
| 4 GPL-family flags | One was reported as AGPL-3.0, four levels down under a charting library. |
| 33 entries | Unknown, SEE LICENSE IN, or custom license entries requiring further review. |
For the ambiguous group, the author reports 26 permissive outcomes, four custom licenses judged clearly permissive, two unresolved packages that were replaced, and one AGPL surprise. Those dispositions describe the author’s review; they do not establish how another organization should classify the same package or license.
Recommended Free Tools
The author characterized the initial metadata sweep as removing “96% of the work for free” and estimated roughly two days spent against two weeks budgeted. Those are the author’s descriptions and estimates for this project, not measured productivity results or a promise of similar savings elsewhere.
How to investigate a flagged transitive dependency
Find who brought it into the tree
Use npm why with the flagged package name to inspect the dependency path and identify its parent. A transitive package’s path helps explain whether it is pulled in by a library used at runtime, a build-time tool, or another dependency. The path is investigation evidence, not by itself a conclusion about legal exposure.
Check what reaches production
Determine whether the package is actually present in production output, rather than assuming that every installed package ships to users. The author checked whether the flagged package was imported at runtime or used at build time and examined the shipped bundle. In the reported AGPL case, the package was in the production bundle. The author says the parent library removed it in a later major version and reports upgrading that parent.
Route the decision to qualified reviewers
Whether a particular license creates a concern depends on the package, how it is used and distributed, and the organization’s circumstances. The author says humans made the risk calls and counsel reviewed the AGPL issue; the author explicitly disclaimed legal expertise for both themselves and Claude Code. Treat the example as a report of one remediation path, not legal advice or a rule that every similarly labeled dependency must be handled identically.
Turn a one-time inventory into a CI control
A license inventory can become stale whenever the lockfile changes. The author recommends rerunning a production-package check in CI, failing closed when an identifier is not on the approved allowlist, and permitting exceptions only when they have written justifications and human review.
Best Value
An allowlist is a policy mechanism, not a legal analysis. Adapt and validate any check for your package manager, dependency classes, production scope, metadata quality, and organizational policy. Make sure an exception names the relevant package and version and preserves the reason and supporting evidence, so a future reviewer can distinguish an intentional decision from an unnoticed change.
For a comparable audit, assess the workflow on five practical dimensions:
- Coverage: Does it include transitive dependencies and packages that reach production?
- Evidence: Does it inspect license files as well as package metadata?
- Traceability: Can a reviewer see the package version, file path, quoted evidence, and dependency path?
- Uncertainty: Does it surface conflicts and allow unresolved cases instead of forcing a guess?
- Continuity: Does it rerun when the lockfile changes and record reviewed exceptions?
Set up Claude Code for this workflow
Installation requirements and methods can change. Anthropic’s current setup documentation lists npm install -g @anthropic-ai/claude-code for a global npm installation, requires Node.js 22 or later for the npm package, and says it installs the same native binary as the standalone installer. Check Anthropic’s Claude Code setup documentation for current instructions. The author’s account of using Claude Code v2.x on Node.js 22.x describes their earlier setup, not the current release.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
