In package.json, set the license field to a current SPDX identifier such as BSD-3-Clause, or to an SPDX expression such as (ISC OR GPL-3.0) when a package is offered under several licenses. For custom terms, use SEE LICENSE IN followed by a filename. Use UNLICENSED for private code you do not want anyone to reuse.
The four cases
The npm documentation covers four cases for the license field:
| Case | What to write |
|---|---|
| Common license | The SPDX identifier, for example BSD-3-Clause |
| Several licenses | An SPDX expression, for example (ISC OR GPL-3.0) |
| Custom or non-SPDX terms | SEE LICENSE IN with a filename at the package top level |
| No rights granted | UNLICENSED, ideally with private set to true |
The docs recommend choosing an OSI approved license where possible. They also say the older license object format and the licenses array are deprecated in favor of SPDX expressions.
Why UNLICENSED and private go together
UNLICENSED tells readers you do not grant permission to use the package. The npm docs suggest also setting private to true so the package is not published by accident. For internal packages, that pair is a small guard against an expensive mistake.
What this means for a buyer
When you inventory npm dependencies, the license field is the first place a scanner looks. Three patterns are worth a closer read:
- A missing field. Treat it as unknown, then check for a LICENSE file in the package.
- SEE LICENSE IN. A human needs to read the referenced file.
- An expression with OR. Someone should decide which option applies and record it. See dual licensed packages.
Steps for your own packages
- Choose the license and find its SPDX identifier.
- Put the identifier in the license field.
- Add the LICENSE file at the package root.
- If code is internal, use UNLICENSED and private true.
- Check the result with a dry run of the packaging command before you publish.
A caution on matching
The field is a claim by the author. It can be out of date or wrong. A scanner can read the field and the files, but when the stakes are high, a person should read the actual text. See license detection expectations.
Safeguard supports policies, gates and guardrails, so a team can decide which findings block a pull request and which only warn. A free scan is available if you want to see your own dependency list first.
Quick check
Is SEE LICENSE IN a valid SPDX value?
No. It is an npm convention for custom terms. The docs say to include the named file at the package top level.
Does UNLICENSED mean public domain?
No. It means you do not grant rights. Public domain is a different thing.
Sources
Last reviewed: 19 October 2026.
