When a scan reports an unknown license, do not guess and do not ignore it. Open the package contents, check the source repository, check the registry page, ask the maintainer if needed, and record what you found. No license means no granted permission by default, so an unresolved unknown should block shipping.
Why default rules matter
GitHub's documentation puts it plainly: without a license, the default copyright laws apply, meaning the author retains all rights and no one may reproduce, distribute or create derivative works from the work. That is why "unknown" is not the same as "free to use".
The five steps
1. Look inside the package itself. Download or unpack the exact version you use. Search for files named LICENSE, COPYING or NOTICE, and check headers in the main source files. Scanners often read metadata only, so a license file in the archive is a common fix.
2. Check the source repository. Open the repository the package points to. A license may sit in the repository root but be missing from the published archive. Note the commit or tag that matches your version.
3. Check the registry page. Registries have a license field. For npm, a custom license can be given as SEE LICENSE IN plus a file name, and UNLICENSED is a documented value meaning the author does not grant use. A scanner that cannot follow the pointer will report unknown.
4. Check other versions. The license may be declared in a newer or older release. A different version can carry different terms, so do not carry a finding across versions without reading it.
5. Ask the maintainer. If nothing is clear, open an issue or send a short message asking which license applies. Keep the reply.
What to do while you wait
You have three honest options while a question is open:
- Pin to a version where the license is clear.
- Replace the package with an alternative that has a clear license.
- Block the package from shipping, and allow it only in non-shipping tooling with a written note.
Do not mark it allowed because the package is popular.
What to record
Write down the package, version, date, where you looked, what you found, and who decided. That note is the evidence you will want later in a customer questionnaire or a due diligence request.
Try it yourself
Click through it at your own pace, or open it full screen. Notice that each component keeps a version, which is what lets you check the right release.
For the inventory that surfaces these rows in the first place, Safeguard offers SBOM and dependency scanning, and a free scan is at gold.safeguard.sh/scan.
Quick check
Is an unknown license the same as a public domain dedication?
No. Public domain use needs an explicit dedication from the author. Silence gives you nothing.
Can a package be unknown in the report but fine in reality?
Yes. Often the license is in the archive or repository and the scanner missed it. Confirm and record it.
Sources
Last reviewed: 19 October 2026.
