Skip to main content

SQ12406

Detected presence of licenses that place restrictions on use in production.

priorityCI/CD statusseverityeffortSAFE levelSAFE assessment
failhighhigh3licenses: fail
Reason: software deployment restrictions

About the issue​

Software license is a legal instrument that governs the use and distribution of software source code and its binary representation. Software publishers have the freedom to choose any commonly used or purposefully written license to publish their work under. While some licenses are liberal and allow almost any kind of distribution, with or without code modification, other licenses are more restrictive and impose rules for their inclusion in other software projects. Some software licenses place restrictions on use of code in production environments. The most restrictive licenses in this category may completely forbid use in production. When building commercial applications, this is typically undesirable. Therefore, the inclusion of any code that may impose limits on how the software may be used is commonly avoided or even prohibited by the organization policy.

How to resolve the issue​

  • Confirm that the software package references a component or a dependency with a restrictive license.
  • Consider replacing the software component with an alternative that offers a license compatible with organization policy.

Incidence statistics​

ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes. Analysis results are used to calculate incidence statistics for issues (policy violations) that Spectra Assure can detect in software packages.

The data in this section is refreshed monthly.

Total amount of packages analyzed

  • RubyGems: 183K
  • Nuget: 644K
  • PyPi: 628K
  • NPM: 3.72M
Statistics are not collected for the SQ12406 policy at this time, or not applicable to this type of issue.