Thanks for the library — the official WASM/AudioWorklet build is genuinely rare and it is why we picked it.
One small packaging gap, with a cause that makes it easy to fix.
The effect
The published tarball for signalsmith-stretch@1.3.2 contains four files and no licence text:
$ npm pack signalsmith-stretch@1.3.2 && tar tzf signalsmith-stretch-1.3.2.tgz
package/SignalsmithStretch.js
package/package.json
package/README.md
package/SignalsmithStretch.mjs
package.json declares "license": "MIT" and the registry shows MIT, so the licence itself is not in doubt. But MIT's operative sentence is about the text travelling with the code:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
So anyone bundling this and generating third-party notices from node_modules ends up reproducing a licence claim where MIT asks for the notice, including the Copyright (c) 2022 Geraint Luff / Signalsmith Audio Ltd. line.
The cause
LICENSE.txt is at the repository root (1093 bytes), but the package publishes from web/release/, which has its own package.json and contains only:
README.md SignalsmithStretch.js SignalsmithStretch.mjs package.json
npm force-includes LICENSE* regardless of files / .npmignore — but only from the package directory. Publishing from a subdirectory that does not contain one produces a tarball without it, which is why this is easy to miss: nothing warns, and the root of the repository is correctly licensed throughout.
Possible fixes
Yours to choose — a copy of LICENSE.txt into web/release/, or a prepack script that copies the root one, would each do it. I have not sent a PR because which of those fits your release process is your call, not mine; happy to send one if you would like a particular shape.
What we did meanwhile
Vendored the text from the repository's LICENSE.txt into our own tree with a note recording where it came from and when, so our notices file reproduces a real notice rather than recording its absence. That works for us but not for anyone who does not notice the gap, which is why it seemed worth reporting.
Verified against the repository tree and the packed tarball on 2026-09-03.
Thanks for the library — the official WASM/
AudioWorkletbuild is genuinely rare and it is why we picked it.One small packaging gap, with a cause that makes it easy to fix.
The effect
The published tarball for
signalsmith-stretch@1.3.2contains four files and no licence text:package.jsondeclares"license": "MIT"and the registry shows MIT, so the licence itself is not in doubt. But MIT's operative sentence is about the text travelling with the code:So anyone bundling this and generating third-party notices from
node_modulesends up reproducing a licence claim where MIT asks for the notice, including theCopyright (c) 2022 Geraint Luff / Signalsmith Audio Ltd.line.The cause
LICENSE.txtis at the repository root (1093 bytes), but the package publishes fromweb/release/, which has its ownpackage.jsonand contains only:npm force-includes
LICENSE*regardless offiles/.npmignore— but only from the package directory. Publishing from a subdirectory that does not contain one produces a tarball without it, which is why this is easy to miss: nothing warns, and the root of the repository is correctly licensed throughout.Possible fixes
Yours to choose — a copy of
LICENSE.txtintoweb/release/, or aprepackscript that copies the root one, would each do it. I have not sent a PR because which of those fits your release process is your call, not mine; happy to send one if you would like a particular shape.What we did meanwhile
Vendored the text from the repository's
LICENSE.txtinto our own tree with a note recording where it came from and when, so our notices file reproduces a real notice rather than recording its absence. That works for us but not for anyone who does not notice the gap, which is why it seemed worth reporting.Verified against the repository tree and the packed tarball on 2026-09-03.