How I Audited 1,400 npm Dependencies for License Risks With Claude Code

Description and use

Automated audit of 1,400 npm dependencies using Claude Code: license scanning, classification, removal of an AGPL‑3.0 package, and a CI gate to prevent regressions.

Problem

A procurement team required a complete license inventory of a product’s third‑party dependencies, revealing 1,400+ transitive packages that had never been audited for license compliance.

Outcome

Implemented a two‑day audit that identified 56 non‑permissive or ambiguous packages out of 1,417, resolved an AGPL dependency, and established a CI gate that automatically blocks future regressions.

Workflow

• 1. Run license-checker-rss to generate a JSON inventory of all dependencies.
• 2. Use Claude Code to summarize license distribution and flag non‑permissive or ambiguous licenses.
• 3. Provide Claude Code a rubric for classification and run it against the 33 unknown/custom packages, requiring a quoted justification for each classification.
• 4. Investigate any copyleft findings (e.g., AGPL) with npm why and the agent’s changelog reading to determine the source and feasibility of removal.
• 5. Create a CI script (check-licenses.mjs) that runs license-checker-rss, filters against an allowed set and exceptions, and fails the build if violations are found.
• 6. Commit the script and run it on every lockfile change to prevent regressions.

Evidence

Read licenses.json. Group packages by license identifier and give me a count per license, sorted descending. Flag anything that is not MIT, ISC, BSD-2-Clause, BSD-3-Clause, Apache-2.0, or 0BSD.

Source

One of the four GPL-family flags turned out to be AGPL-3.0, sitting four levels deep under a charting library.

Source

// scripts/check-licenses.mjs — runs in CI on every lockfile change

Source