I've got a package.json that's expecting a SPDX-approved license acronym, but I can't find one that means 'proprietary commercial license, all rights reserved'.

Is there one for non-FOSS, where I want to specify that I want to allow no reuse?

  • 2
    There are some problems with your question, as it is currently written. 1. All copyrights are always reserved. 2. "Proprietary commercial" is a characteristic of many licenses. 3. There might not actually be an acronym for what you are requesting. Commented Jun 5, 2015 at 5:11
  • 3
    @RobertHarvey 1. Many software systems (eg, npm) require a license to be set explicitly. 2 and 3. Yes, the answer handles that 3. Commented Jul 12, 2015 at 20:44
  • 2
    Since this is closed I can't give another answer. But according to [1] you should set license: "UNLICENSED",. [1] github.com/npm/npm/issues/8918 Commented Oct 2, 2015 at 20:04
  • 1
    might not actually [have] an acronym for what you are requesting is still a perfectly valid answer to a perfectly valid question. Commented Sep 15, 2016 at 4:51
  • 1
    The equivalent for composer.json is "license": "proprietary" according to the docs. Commented Oct 16, 2019 at 19:58

3 Answers 3


As of npm 3.10 you have to use UNLICENSED:

{ "license": "UNLICENSED"}


{ "license": "SEE LICENSE IN <filename>"}

The value of license must either one of the options above or the identifier for the license from this list of SPDX licenses. Any other value is not valid.

The following is no longer valid for current versions of npm

For npm versions before 3.10 you may use:

{ "license" : "LicenseRef-LICENSE" }

Then include a LICENSE file at the top level of the package. It could be as short as:

(c) Copyright 2015 person or company, all rights reserved.

But you might want to be more explicit about what is not allowed.

  • 22
    "all rights reserved", in that context, means EXACTLY what it says. NO permissions have been given. It is a legal term of art. Think of it as a magickal incantation that must be uttered in precisely that form to invoke the Law Demons. Commented Jun 5, 2015 at 20:45
  • 5
    npm recommends to set { "license": "UNLICENSED"} "if you do not wish to grant others the right to use a private or unpublished package under any terms". That's an even easier option than an explicit license file. Commented Sep 28, 2015 at 9:49
  • 3
    setting the license to UNLICENSED still triggers license should be a valid SPDX license expression for me
    – cdmckay
    Commented Oct 9, 2015 at 13:33
  • 22
    You can also just set "private": true and it won't bother you about including a license.
    – spex
    Commented May 25, 2017 at 20:31
  • 17
    Also make sure not to confuse the npm-recommended "UNLICENSED" with the SPDX compliant identifier "Unlicense", which is the exact opposite of "all rights reserved". Commented Oct 17, 2017 at 11:04

This does not exactly answer your question, but what about:

  "license": "Proprietary",
  "private": true,
  • 3
    This answer reads more like a comment.
    – Mael
    Commented Mar 13, 2018 at 7:40
  • 3
    This answer also does what is needed: stops npm complaining about licenses, so it is a good one in my book. Commented Apr 26, 2018 at 9:20
  • 6
    Using "Proprietary" as the license type is not a supported SPDX type and will generate an error unless you also specify "private": true. That in turn prevents you from using NPM as a distribution channel for your proprietary package. So choose the answer above by @craig
    – abd3721
    Commented Nov 1, 2018 at 21:18
  • 1
    To me, the following DOES answer the question and gives a full example of how to do it. I suggest, @WooYek, updating your answer. ` { "name": "my-descriptive-name", "description": "yeah, what it says", "repository": "npm/npm", "license": "Copyright Your Company 2019, all rights reserved.", "private": true, "dependencies": { "request": "^2.88.0", "request-promise-native": "^1.0.5" } }` Commented Jan 15, 2019 at 23:36
  • 1
    For brevity I did not want to put the usual copyright stuff. Just the bare minimum required for a packaged to be treated as proprietary software.
    – WooYek
    Commented Jan 17, 2019 at 7:38

Not so sure about specifically npm, but SPDX standard version 1.2 (2013) and later has provision for specifying arbitrary custom licensing terms, in their machine-readable license expressions format. Section Other Licensing Information Detected:

5.1.4 Data Format: "LicenseRef-"[idString]
  [idString] is a unique string containing letters, numbers, “.”, “-” or “+”.

This is also present in the latest (today) spec version 2.3 (2022).

So basically, we should be able to say:

  • {"license": "LicenseRef-Proprietary"},
  • {"license": "LicenseRef-Custom-Commercial-Agreement"},
  • {"license": "LicenseRef-PrivateUndisclosed"},

and so on, along those lines.

Relatedly, there's also the special keyword NOASSERTION — but it isn't considered a "valid SPDX License Expression", and I'm not positive if it's intended for package developers. See PackageLicenseDeclared: that keyword is apparently for license-scanning software to express "I failed to determine the SPDX ID of the package's license, or didn't even try".

  • This is actually the correct way
    – jdsika
    Commented Apr 16 at 11:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.