A blank field on a package page means the data was not captured, not that the answer is fine. Treat a blank license as unknown until you read it in the repository, and a blank maintainer as unknown until you check the registry. Missing metadata is a prompt to verify, not a pass.
Why fields end up blank
Directory pages build from registry metadata and repository data. Registries differ in what they require. Authors forget to declare a license field. Some projects keep the license only in a file. Others list no maintainer publicly. On Gold pages we reviewed, license, maintainer and size were sometimes empty, and in one case the checklist item for license carried text saying it was not identified in metadata.
License: how to verify
- Open the repository from the page link.
- Find the LICENSE file and read the actual text.
- Check the registry listing for a license field. If the two disagree, the repository text usually carries more weight, but ask a lawyer if it matters.
- If there is no license at all, the default in many jurisdictions is that you have no right to use or modify the code. Do not assume permission.
This is general information, not legal advice.
Maintainer: how to verify
Check the registry page for the owner or publisher, and the repository for active contributors. Ask whether one person holds publish rights to a package you depend on, since that affects continuity and takeover risk. A recent change of owner is worth a closer look.
Size and other metadata
Size is a convenience. A blank is rarely decisive, but a surprisingly large package for a simple purpose is worth opening to see what it contains.
What the checklist can and cannot show
The Gold checklist has an item for license identified. Where its sentence says the license was not identified, follow the sentence. Do not rely on a mark alone. The same applies to the provenance item.
Build a rule your team can follow
- Missing license: do not add until confirmed.
- Missing maintainer: check the registry, then decide.
- Missing repository link: treat as a red flag.
- Anything blank on a package that handles secrets or network input: escalate.
Automate it
Safeguard policies can flag components with unknown licenses at pull request time, so the decision does not depend on someone remembering. You can start by scanning a manifest at gold.safeguard.sh/scan.
Quick check
Is an unlicensed package free to use?
Not automatically. Without a license you may have no permission to use it. Ask the author or pick another package.
Sources
Last reviewed: 19 October 2026.
