No license means the author has granted no permission. Unknown means the scanner could not identify the license, which may exist. Custom means a real license with non-standard terms. They look alike in a report but need different actions: stop, investigate, or read and decide.
The three states
| State | What it means | First action |
|---|---|---|
| No license | No license text or grant found after checking the package and source | Do not use in shipped software until the author grants one |
| Unknown | The tool could not match a license, but one may exist | Open the package and read the files |
| Custom | A license exists but its terms are not a standard one | Read it, classify it, record a decision |
No license
GitHub's documentation says that without a license, default copyright laws apply, so the author retains all rights and no one may reproduce, distribute or create derivative works. Public visibility does not change that for general use. For npm, a package can state UNLICENSED, which the documentation describes as a way to say you do not grant others the right to use the package.
Unknown
Unknown is a statement about the scanner, not the package. Usual causes are a missing metadata field, a license file with an unusual name, or edited license text. After you look, an unknown usually becomes one of the other two states, or a standard license that the tool missed. See what to do first when a scan says unknown.
Custom
A custom license may be a standard one with an added condition, such as the JSON license with its Good, not Evil sentence, or a bespoke commercial or source available text. Classify it by what it asks: notices, source sharing, field of use limits, or payment. Record it with a local identifier, and tier it in your policy.
Decision flow
- Did you find license text anywhere in the package or repo? If no, treat as no license.
- Does the text match a standard license? If yes, record the SPDX identifier.
- If it does not, treat as custom and route to review.
- In all cases, write down what you checked.
A reporting tip
Keep these three as separate values in your own reports. Lumping them as unknown hides the cases where nothing was granted, which are the most serious.
This post is practical guidance and not legal advice.
Quick check
Can I use a package with no license if it is on a public repo?
Seeing code is not the same as having permission to use it. Ask the author to add a license.
Is custom always worse than standard?
No. It simply takes longer to review because no policy entry exists yet.
Safeguard's SBOM and dependency scanning helps surface these rows in the inventory.
Sources
Last reviewed: 19 October 2026.
