Code published without a license is not free to use. Copyright applies by default and the author keeps every right they did not give away.
On this page
What it does
This is the absence of a license, not a kind of license. When an author publishes code and says nothing about terms, copyright law fills the gap, and the default in most countries is that all rights are reserved. Putting the code on a public registry does not change that. Publishing to npm grants npm and its users the rights npm's own terms describe, for running the registry. It does not grant you a license to put the code in your product. A large share of small repositories on GitHub are in this position.
Details
With no license you have no permission to copy, modify, redistribute or ship the code. That holds however convenient the package is, and however long it has been in your build. An internal-only tool carries lower practical exposure, but the legal position is the same. Treat accepting it as a decision somebody writes down, not as an assumption. The worst case is a library or SDK you hand to other developers, because there you would be passing on rights you never had. Ask the maintainer, or replace the dependency.
Pros
- Naming the situation (no license, dual license, exception, custom text) is better than forcing a nearby SPDX id.
- Once the files are read, the rest of the review looks like any other component.
Cons
- Auto-fetch and SPDX matching will not finish this for you. A person has to read what shipped.
- Wrong SPDX on a dual-license or LicenseRef package is a common attestation error.
What it allows and requires
Choose a category to see the full grant in one scannable list. Permissions show what the license allows, limits show what it withholds, and obligations show the conditions your release process must satisfy.
Permissions
Nothing granted
All-rights-reserved code grants you no license. You may not copy, modify, or distribute it unless you get a separate grant.
Limits
Ship it
Publishing or embedding this code without a license is infringement, not a paperwork miss.
Obligations
Get a grant
Ask the author for a license, replace the component, or remove it. SourceTrust flags this so it cannot hide as MIT-shaped.
What no-license requires when you ship
no-license is a situation more than a standard grant. Read what is actually on the component, then record that, rather than hoping a nearby SPDX id covers it. The steps below are how to keep the record tied to the text you actually have.
You have looked where a license actually hides before concluding there is none: the README, the file headers, the package manifest, and the source repository.
You have asked the maintainer in writing and have their answer. A polite issue asking them to add a license works more often than people expect.
You have replaced or removed the dependency when no permission arrives. For anything you ship, that is the only reliable answer.
You have written down the decision and the evidence if your organization accepts the exposure for an internal tool. An accepted exposure is a decision, not an assumption.
You have kept it out of any product, binary or library you hand to someone else, where you would be sub-licensing rights you do not hold.
The duties named in no-license
There is no standard grant to scan. Record the identifier and the text that is actually on the component, then treat nearby SPDX ids as other pages, not as substitutes.
Get a grant
Ask the author for a license, replace the component, or remove it. SourceTrust flags this so it cannot hide as MIT-shaped.
Things to be aware of
- Teams read no LICENSE file as no license. The terms may sit in the README, in the file headers, or in the package manifest, and any of those counts.
- Teams read no license as public domain. It is the opposite: with no license the author keeps every right, and public domain gives them all away.
- Teams confuse UNLICENSED in a package manifest with the SPDX id Unlicense. The first means deliberately not licensed, the second is a public domain dedication.
- Teams treat a not found result as proof of absence. It can also mean the artifact was too large to inspect, which is a limit of the fetch and not a fact about the package.
What the No license at all does not do
Search results often flatten No license at all into a slogan. These are the usual misreads. no-license is a grant with conditions, not a permission to skip the paperwork below.
- No license is not implied MIT. All-rights-reserved is the default when the author said nothing.
- It does not become legal to ship just because the package is popular.
How no-license differs from nearby licenses
These licenses are often confused with no-license, but their release duties differ. Each row summarizes what the license requires when you ship. Open the linked page for the full checklist.
- no-license
- Code published without a license is not free to use. Copyright applies by default and the author keeps every right they did not give away.
- public-domain
- Public domain is a status, not a license. Nothing is asked of you when the status is real, and the risk is that it often is not.
- proprietary
- Not open source. The agreement you signed sets the terms, so the text you attach and the limits you record are the whole record.
- licenseref
- A LicenseRef id is a pointer, not a license. It says the text lives elsewhere in the document, so somebody has to go and read it.
Common questions about No license at all
Answers to common questions about what No license at all requires, when its duties apply, and what evidence belongs with a release.
What is the No license at all?
This is the absence of a license, not a kind of license. When an author publishes code and says nothing about terms, copyright law fills the gap, and the default in most countries is that all rights are reserved. Putting the code on a public registry does not change that. Publishing to npm grants npm and its users the rights npm's own terms describe, for running the registry. It does not grant you a license to put the code in your product. A large share of small repositories on GitHub are in this position.
What does no-license require when you ship a product?
You have looked where a license actually hides before concluding there is none: the README, the file headers, the package manifest, and the source repository. You have asked the maintainer in writing and have their answer. A polite issue asking them to add a license works more often than people expect. You have replaced or removed the dependency when no permission arrives. For anything you ship, that is the only reliable answer. You have written down the decision and the evidence if your organization accepts the exposure for an internal tool. An accepted exposure is a decision, not an assumption. You have kept it out of any product, binary or library you hand to someone else, where you would be sub-licensing rights you do not hold.
Why does no-license sit under special cases?
no-license is a situation rather than a standard public grant: no license, a choice between licenses, an exception, a custom identifier, or a text that fits none of the families above. Each one is decided by reading what is actually there.
How is no-license different from Public domain?
no-license asks this: Code published without a license is not free to use. Copyright applies by default and the author keeps every right they did not give away. Public domain asks this: Public domain is a status, not a license. Nothing is asked of you when the status is real, and the risk is that it often is not. Open the Public domain page for what that license requires when you ship. Do not treat the SPDX ids as interchangeable because the short names look similar.
Where do I record no-license for a buyer?
SourceTrust separates three findings that look alike. The package declares no license and no license file is found anywhere: the resolution lands on the proprietary state, which is the all rights reserved reading. An id is declared but the text for that exact version is missing: the result is unconfirmed, and the terms are almost certainly the ordinary ones for that id. The fetch cannot produce text at all: the result is not found, and it carries a cause. Only the first is really no license.
Where do I record no-license for a buyer?
SourceTrust separates three findings that look alike. The package declares no license and no license file is found anywhere: the resolution lands on the proprietary state, which is the all rights reserved reading.
An id is declared but the text for that exact version is missing: the result is unconfirmed, and the terms are almost certainly the ordinary ones for that id. The fetch cannot produce text at all: the result is not found, and it carries a cause.
Only the first is really no license. Read /docs/auto-fetch-license.
- The not found cause tells you which situation you are in: the artifact ships no license file, the version was never published, or the artifact was too large to inspect.
- None of these states fills in license text by itself. Only confirmed does that, so a person accepts every other outcome explicitly.
- The evidence links the fetch collected, the registry page and the source repository, sit next to the finding so you can go and look for yourself.
See also
The hub is the pillar for this cluster. Sibling licenses are the other spokes. Product FAQ links explain how SourceTrust records the duty, not the license text itself.
Practical guidance for procurement review, not legal advice. Confirm high-stakes use with counsel.