Claude code third party license

[bcmyguest]

Curious anthropic/google/etc. don't bother to post third party licenses in their npm registries? Isn't that just plain and simple copyright violation?

[sindresorhus]

It is, but who's going to enforce it.

[bcmyguest]

:(

[costajohnt]

I built a tool to help with this: ink-license-check

It's a zero-dependency Node.js CLI that downloads npm tarballs and scans for missing Ink MIT license attribution. It checks both declared dependencies in package.json and bundled code (for packages that webpack/esbuild ink into a single file).

I ran it against all 5,221 packages listed on Ink's GitHub dependents page. Of the ones with meaningful download counts, here are the highlights:

Commercial violations (missing attribution):

Package	Downloads/mo	Company
@anthropic-ai/claude-code	42.8M	Anthropic
@oclif/table	2.4M	Salesforce
gatsby-cli	1.6M	Gatsby
@shopify/cli	1.1M	Shopify
@tapjs/reporter	889k	tap
cdktf-cli	816k	HashiCorp
cline	609k	Cline
@gitlab/duo-cli	144k	GitLab

Plus Amplitude, Datadog, Prisma, BlitzJS, and others. 24 ink ecosystem extension packages (ink-gradient, ink-table, ink-link, etc.) also lack attribution.

Only 7 packages properly include the copyright notice: ink-spinner, ink-text-input, ink-select-input, ink-testing-library, @inkjs/ui, pastel, and ink-multi-select.

Full report with methodology: https://github.com/costajohnt/ink-license-check/blob/main/report.md

The tool supports --report for generating markdown reports and --min-downloads for filtering to high-download packages. Happy to discuss next steps on enforcement — the tool could be extended to auto-open polite GitHub issues on violating repos.