License scanner

Open your package-lock.json (or a CycloneDX / SPDX SBOM file) to see every license your project depends on, which ones may cause trouble for how you plan to use the code, and a notices list you can ship. It runs in your browser, so your dependency list stays private.

This is a first-pass screen, not legal advice. It reads the license names that package metadata declares, and those can be missing or wrong. "A OR B" licenses are treated as the friendlier option; "A AND B" as the stricter. How a license applies depends on how you link, bundle and distribute the code, so ask a lawyer before shipping anything that matters. A lock file doesn't include the full license texts, which you'll need to include for most licenses.