NPM - can I use module with MIT license, even if it requires submodule with CC-BY license?

Question

as the title implies, I've installed some npm packages - all of which I've knowingly installed and requested are published under MIT, ISC, Apache 2, or other permissive license.

However, some of these packages, which I require in the package.json, require other packages with less permissive licenses, such as CC-BY-3.0 or CC-BY-4.0.

I would like to use the packages I required in a project for commercial use. What are my obligations regarding the licenses? Are there any, as I've not required the non-permissive licensed modules directly?

Any help will be appreciated.

Answer 1

I would like to use the packages I required in a project for commercial use. What are my obligations regarding the licenses? Are there any, as I've not required the non-permissive licensed modules directly?

When you redistribute NPM packages (or any package) you need to consider the chain of dependencies at full depth all the way down. I provided a comprehensive overview of dependencies here

You therefore have to consider and comply with any and all the licenses of the packages whether these are direct or indirect dependencies.

If you are not comfortable with the licenses of some packages in that tree you could either:

1. contact the authors to ask for an other license
2. fork or patch the packages to remove the deps you do not like and replace (or rewrite) with something else.

FWIW, the CC-BY licenses are rather permissive with only a few more requirements than an MIT. They are also pretty poor licensing choices for software. Ask your lawyers if they are comfy with this or not in your context.

So, I understand that I have to comply also with the CC-BY license. Would it be enough to mention the author somewhere on an 'about' page?

It is unlikely to be enough, for the CC-BY 4.0, the short non-legal code states:

Attribution — You must give appropriate credit, provide a link to the
license, and indicate if changes were made. You may do so in any
reasonable manner, but not in any way that suggests the licensor
endorses you or your use

And then in slightly more details:

If supplied, you must provide the name of the creator and attribution
parties, a copyright notice, a license notice, a disclaimer notice, and
a link to the material. CC licenses prior to Version 4.0 also require
you to provide the title of the material if supplied, and may have other
slight differences.

we are going to use a lot of different node modules [...] would it be sufficient to dedicate one page to these attributions? On that page, each of the modules would be properly attributed - with the name of the creator and attribution parties, a copyright notice, a license notice, a disclaimer notice, and a link to the material.

It may depend on the license as some license may require a more prominent attribute, though in practice that should suffice and this is a common way to these things. You would also want to ensure that the source code of copyleft-licensed modules (such as LGPL, MPL, etc) is provided or available. If you do not minimize your code and use them as-is, then this comes for free with node_modules.

As a side note, there are a few node/npm utilities to help with this and also AttributeCode (which is in Python and that I co-maintain)