SQ12407
Detected presence of licenses that prohibit software modification.
| priority | CI/CD status | severity | effort | SAFE level | SAFE assessment |
|---|---|---|---|---|---|
 | pass | medium | high | None | licenses: warning Reason: software modification restrictions |
About the issue
Software license is a legal instrument that governs the use and distribution of software source code and its binary representation. Software publishers have the freedom to choose any commonly used or purposefully written license to publish their work under. While some licenses are liberal and allow almost any kind of distribution, with or without code modification, other licenses are more restrictive and impose rules for their inclusion in other software projects. Some software licenses place restrictions on creation of derivative works by prohibiting any kind of software modification. When building commercial applications, this may be undesirable as third-party code often needs to be adapted for use in software projects. Therefore, the inclusion of any code that prohibits software modifications is commonly avoided or even prohibited by the organization policy.
How to resolve the issue
- Confirm that the software package references a component or a dependency with a restrictive license.
- Consider replacing the software component with an alternative that offers a license compatible with organization policy.
Incidence statistics
ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes. Analysis results are used to calculate incidence statistics for issues (policy violations) that Spectra Assure can detect in software packages.
This section is updated when new data becomes available.
Total amount of packages analyzed
- RubyGems: 183K
- Nuget: 644K
- PyPi: 628K
- NPM: 3.72M
Recommended reading
- Software license (External resource - Wikipedia)
- OSS Watch License Differentiator tool (External resource - OSS Watch)