SQ12404
Detected presence of licenses that place restrictions on commercial use.
| priority | CI/CD status | severity | effort | SAFE level | SAFE assessment |
|---|---|---|---|---|---|
 | pass | medium | high | None | licenses: warning Reason: commercial use restrictions |
About the issue
Software license is a legal instrument that governs the use and distribution of software source code and its binary representation. Software publishers have the freedom to choose any commonly used or purposefully written license to publish their work under. While some licenses are liberal and allow almost any kind of distribution, with or without code modification, other licenses are more restrictive and impose rules for their inclusion in other software projects. Some software licenses place restrictions on commercial use of the code they apply to. The most restrictive licenses in this category may completely forbid commercial code use. When building commercial applications, this is typically undesirable. Therefore, the inclusion of any code that may impose limits on commercial use is commonly avoided or even prohibited by the organization policy.
How to resolve the issue
- Confirm that the software package references a component or a dependency with a restrictive license.
- Consider replacing the software component with an alternative that offers a license compatible with organization policy.
Incidence statistics
ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes. Analysis results are used to calculate incidence statistics for issues (policy violations) that Spectra Assure can detect in software packages.
This section is updated when new data becomes available.
Total amount of packages analyzed
- RubyGems: 183K
- Nuget: 644K
- PyPi: 628K
- NPM: 3.72M
Recommended reading
- Software license (External resource - Wikipedia)
- OSS Watch License Differentiator tool (External resource - OSS Watch)