Development on spdx.js has moved to separate, smaller packages.
spdx-expression-parse and spdx-satisfies are direct successors to spdx.js.
You may also be interested in spdx-compare, spdx-correct, and other packages on the npm public registry. kemitchell writes a lot of them.
var spdx = require('spdx')var assert = require('assert')
assert(spdx.valid('Invalid-Identifier') === null)
assert(spdx.valid('GPL-2.0'))
assert(spdx.valid('GPL-2.0+'))
assert(spdx.valid('LicenseRef-23'))
assert(spdx.valid('LicenseRef-MIT-Style-1'))
assert(spdx.valid('DocumentRef-spdx-tool-1.2:LicenseRef-MIT-Style-2'))assert(spdx.valid('(LGPL-2.1 OR MIT)'))
assert(spdx.valid('(LGPL-2.1 OR MIT OR BSD-3-Clause)'))assert(spdx.valid('(LGPL-2.1 AND MIT)'))
assert(spdx.valid('(LGPL-2.1 AND MIT AND BSD-2-Clause)'))assert(spdx.valid('(GPL-2.0+ WITH Bison-exception-2.2)'))assert.deepEqual(
spdx.parse('(LGPL-2.1 OR BSD-3-Clause AND MIT)'),
{ left: { license: 'LGPL-2.1' },
conjunction: 'or',
right: {
left: { license: 'BSD-3-Clause' },
conjunction: 'and',
right: { license: 'MIT' } } })
assert.deepEqual(
spdx.parse('(MIT AND (LGPL-2.1+ AND BSD-3-Clause))'),
{ left: { license: 'MIT' },
conjunction: 'and',
right: {
left: {
license: 'LGPL-2.1',
plus: true },
conjunction: 'and',
right: { license: 'BSD-3-Clause' } } })assert(!spdx.valid('MIT '))
assert(!spdx.valid(' MIT'))
assert(!spdx.valid('MIT AND BSD-3-Clause'))assert(Array.isArray(spdx.licenses))
assert(spdx.licenses.indexOf('ISC') > -1)
assert(spdx.licenses.indexOf('Apache-1.7') < 0)
assert(spdx.licenses.every(function(element) {
return typeof element === 'string' }))
assert(Array.isArray(spdx.exceptions))
assert(spdx.exceptions.indexOf('GCC-exception-3.1') > -1)
assert(spdx.exceptions.every(function(element) {
return typeof element === 'string' }))assert.equal(spdx.specificationVersion, '2.0')The Software Package Data Exchange (SPDX) specification is the work of the Linux Foundation and its contributors, and is licensed under the terms of the Creative Commons Attribution License 3.0 Unported (SPDX: "CC-BY-3.0"). "SPDX" is a United States federally registered trademark of the Linux Foundation.