I have forked and modified a legacy open-source NPM package for my personal use. And I thought publishing my modification might be useful for others.

The "heavily modified" in my case is:

  • Convert the code into modern JavaScript
  • Aim to run on a different platform (originally intended to run only on Node.js but my modification intend to also compatible with client-side JavaScript)
    • Due to client-side limitations some functionality has been removed but still retains the functions that are the main goal of this package.

Overall: The modified package is not compatible with original version and cannot be merged together.

I have contributed to few open-source project but never forked and publishing it as a separate project. So, here's my question:

  • The LGPL-3.0 allow the modification and distribution on conditions to disclosure source and state changes.
    • Is it enough to just stated in the readme as "forked of ..." and about the modification I made?
  • Publishing on NPM
    • Does "disclosure source" means to list original author as the package author? Or can I publish it under my name with author as contributors?

Additional infos

  • The package is 7 years old and not actively maintained (the last commit is 7 months ago)
  • The package is licensed under the LGPL-3.0 License

1 Answer 1


The source that you are required to disclose according to the LGPL is not the project you forked from, but the source code of your package. And the LGPL defines source code as "the format that is preferred for making modifications".

Stating in your readme which package you forked from and what changes you made to it is not wrong, but it is not what is required by the LGPL license.

The "state changes" requirement of the LGPL is usually satisfied by either maintaining a CHANGELOG file, which lists the changes for each version, or through the revision history of your repository.

When publishing on NPM, if you publish a non-source (e.g. minified) package, then the recipients must be able to easily find the corresponding source code of that package. I am not familiar enough with NPM to know what the customs are, but that could mean mentioning your repository in the package documentation or publishing a separate source code package.

The LGPL does not have any requirement who should be mentioned as author or contributor of a package on NPM. As far as the LGPL is concerned, the relevant authorship information is contained in the copyright lines in the source code and those need to be preserved.

  • Thanks, does the repository revision history equals to Git commit history? If that the case I store the source code in a new repository (no previous commit from original repository) so the CHANGELOG file is required in the case?
    – phwt
    Apr 22, 2021 at 8:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.