Yes. A license applies to every package that ends up in what you ship or run, whether you chose it or a dependency pulled it in. Most of a typical dependency tree is transitive, so a license review that stops at your direct dependencies misses most of the terms you are bound by.
Why the top level is misleading
Package managers show direct dependencies by default. npm's documentation notes that npm ls lists only top level dependencies unless you add the all flag, which shows the full logical tree. A review built on the short list covers a small share of the real set.
A permissive direct dependency can pull in a package under a stricter license. Your obligations follow the code that is present in your build, not the package you intended to adopt.
What changes the answer
| Factor | Effect |
|---|---|
| Shipped in your artifact | Obligations may apply to you |
| Dev or test only | Often not shipped, but check build outputs |
| Optional or peer dependency | Depends on whether it is installed |
| Bundled into a front end | Shipped to every user |
| Linked into a binary | Shipped with the binary |
Scope matters. A test runner under a copyleft license that never reaches your artifact is a different case from a library bundled into your website. Do not assume either way. Check what your build actually outputs.
How to cover the full tree
- Generate the full tree from the lockfile, not from the manifest. See how to find transitive dependencies.
- Mark each package as shipped or build time only.
- Read license values for every shipped package and normalize them.
- Apply your policy tiers to the whole set. See allow, review, deny tiers.
- For problem licenses deep in the tree, decide: replace the parent, override the version, or accept with conditions. See how to pin a transitive dependency.
Depth in your SBOM
An SBOM that lists only direct dependencies cannot answer a license question for the rest. See SBOM depth and transitive dependencies.
Try it yourself
Click through it at your own pace, or open it full screen.
Compare how many components appear when you include transitive ones, and check the license on a few deep entries.
Keep a record of why a deep package is acceptable, especially when it sits under a stricter license than its parent. Reviewers who see the same finding a year later should not have to repeat the analysis. A short note with the date, the shipped or build only call, and the decision is enough.
Safeguard scans direct and transitive dependencies and produces SBOMs. Try a free scan.
Quick check
Do dev dependencies need license review?
If they do not reach your shipped artifact, obligations are usually lighter, but verify what your build outputs.
How do I see transitive packages in npm?
Run npm ls with the all flag to show the full tree.
Sources
- npm Docs, npm ls: https://docs.npmjs.com/cli/v10/commands/npm-ls
Last reviewed: 19 October 2026.
