How I Audited 1,400 npm Dependencies for License Risks With Claude Code

说明与用途

使用 Claude Code 对 1,400 个 npm 依赖进行自动化审计：扫描许可证、分类、移除 AGPL‑3.0 包，并通过 CI 门控防止回归。

问题

A procurement team required a complete license inventory of a product’s third‑party dependencies, revealing 1,400+ transitive packages that had never been audited for license compliance.

结果

Implemented a two‑day audit that identified 56 non‑permissive or ambiguous packages out of 1,417, resolved an AGPL dependency, and established a CI gate that automatically blocks future regressions.

工作流

• 1. Run license-checker-rss to generate a JSON inventory of all dependencies.
• 2. Use Claude Code to summarize license distribution and flag non‑permissive or ambiguous licenses.
• 3. Provide Claude Code a rubric for classification and run it against the 33 unknown/custom packages, requiring a quoted justification for each classification.
• 4. Investigate any copyleft findings (e.g., AGPL) with npm why and the agent’s changelog reading to determine the source and feasibility of removal.
• 5. Create a CI script (check-licenses.mjs) that runs license-checker-rss, filters against an allowed set and exceptions, and fails the build if violations are found.
• 6. Commit the script and run it on every lockfile change to prevent regressions.

证据

Read licenses.json. Group packages by license identifier and give me a count per license, sorted descending. Flag anything that is not MIT, ISC, BSD-2-Clause, BSD-3-Clause, Apache-2.0, or 0BSD.

来源

One of the four GPL-family flags turned out to be AGPL-3.0, sitting four levels deep under a charting library.

来源

// scripts/check-licenses.mjs — runs in CI on every lockfile change

来源