--- title: "FOSSA partners with npm to deliver open source license compliance" description: "FOSSA introduces a new add-on for npm Enterprise to enhance open source license compliance." canonical_url: "https://fossa.com/blog/fossa-partners-with-npm-to-deliver-open-source-license-compliance/" markdown_url: "https://fossa.com/blog/fossa-partners-with-npm-to-deliver-open-source-license-compliance.md" content_type: "blog" language: "en" date_published: "2016-07-05" date_modified: "2016-07-05" author: "Kevin Wang" organization: "FOSSA" --- # FOSSA partners with npm to deliver open source license compliance > FOSSA introduces a new add-on for npm Enterprise to enhance open source license compliance. _Read npm’s companion announcement [here](http://blog.npmjs.org/post/146943134240/npm-add-ons)._ ### Introducing FOSSA’s npm Enterprise add-on Today we’re introducing the **FOSSA Licenses add-on**, a plugin for npm Enterprise (npmE) that adds automated open source license compliance to the fast and powerful JavaScript workflow. This is part of a broader partnership with [npm](https://npmjs.org/) to reduce barriers to JavaScript adoption in the enterprise. FOSSA’s Licenses add-on proactively assesses both public and proprietary packages in a company’s npmE registry to identify licensing issues and obligations. npmE users will be able to view an at-a-glance summary of a package’s licensing impact online before deciding to download and integrate into their products. For proprietary code on npm Enterprise, FOSSA will maintain ongoing scans that span every line of code across a package’s deepest dependencies and notify its team of licensing issues in real-time. For any discoveries, FOSSA provides: - Rich workflows to guide users step-by-step in fixing problems - Context-aware suggestions on how to fix issues - Email reporting and summaries per-commit or publish - Syncing and assigning companion tickets in JIRA and GitHub When code is shipped, FOSSA generates Bill of Materials, attribution files and other materials to help you comply with license obligations. Companies can configure FOSSA’s analysis to ensure developers only use code governed by certain terms, policies, or pass a battery of licensing integrity tests. To learn more about FOSSA’s features, visit our [homepage](http://fossa.io/). Installing this add-on is easy — simply SSH into your npm Enterprise node and run: ```bash npm addon http://{fossa_host}/api/services/npm ``` And this is just a start: we look forward to expanding upon npm Enterprise with more features and tighter integrations over time to make JavaScript evermore enterprise-ready. ### The need for compliance tooling in JavaScript JavaScript development moves uniquely fast due to a huge part of the developer workflow relying on high-quality code sharing. At the center of this is npm, the largest software registry in the world with over 300,000 community-built modules and almost 5 billion downloads each month. In npm, modules are often small, self-contained, and single-purposed, allowing developers to maximize code sharing and reuse. JavaScript development takes advantage of this third-party code to solve common problems and assemble high-quality features at great speed. This happens to such an extent that many JavaScript apps are comprised mostly of open source and third-party code. Reusing third-party code on such a large scale means that developers’ projects are constantly inheriting intellectual property and licensing obligations from hundreds of different sources, even by including only a few modules. Many of these components don’t properly document, track, or assess the licensing implications of the code they reuse, which surfaces problems for companies as they fundraise, close deals, sell, or go through litigation. Managing this complexity is an immense, ongoing challenge. Large organizations dedicate attorney time to manual, retroactive audits which slow development, incur high costs, are prone to error and scale poorly. Smaller companies simply can’t afford to do this and end up discovering problems during critical moments of growth. The rate and scale at which developers include third-party code in JavaScript is too great for manual labor to handle effectively. Balancing rapid development with a business’s strict legal needs requires proactive and integrated tooling that scales with the demands of large projects yet is smart and approachable enough to engage developers. That’s why we built FOSSA — a tool to condense compliance work into just a few clicks in the web browser. FOSSA sits on top of your code to proactively analyze your open source dependencies and maintain a plain-English checklist of license obligations. Our goal is to enable simple, scalable compliance behind the developer workflow with smart features to help you find and fix licensing issues. ### More on FOSSA FOSSA is currently in private beta, with the npm Enterprise add-on available today to our current customers. We’ll go into wider availability and share more about our company in the months ahead. If you’d like to try FOSSA in the cloud today or learn more about our on-prem solution, contact [support@fossa.com](mailto:support@fossa.com) with a bit of detail about your company’s goals. To stay in the loop with e-mail updates, sign up below. FOSSA was built by the team behind [TLDRLegal](https://tldrlegal.com/) and is working with some great lawyers like Heather Meeker (author of MPL and Mozilla ToS). ## Related resources - [Analyzing 5 Major OSS License Compliance Lawsuits](https://fossa.com/blog/analyzing-5-major-oss-license-compliance-lawsuits.md): Learn about five lawsuits that have helped shape global enforcement of open source software licenses. - [May 2025 FOSSA Product Updates](https://fossa.com/blog/may-2025-product-updates.md): Learn about several recent FOSSA product updates, including container scanning and CycloneDX report improvements. - [Annotate Dependencies with Context: Introducing Package Labels in FOSSA](https://fossa.com/blog/annotate-dependencies-context-introducing-package-labels.md): Introducing FOSSA Package Labels - a powerful way to annotate packages with contextual metadata, enabling more efficient and insightful reporting and filtering. - [License Compliance, SBOM, and Vulnerability Management for Smaller Teams: FOSSA Business Tier](https://fossa.com/blog/fossa-business-tier.md): FOSSA introduces a new business tier tailored for smaller teams, offering flexible pricing and comprehensive features for SBOM, vulnerability management, and license compliance. - [Fall 2024 Software Licensing Roundup](https://fossa.com/blog/fall-2024-software-licensing-roundup.md): Explore the significant licensing stories of fall 2024, including Elastics return to open source, the new fair source licensing model, and the PearAI controversy. ## Source Canonical page: https://fossa.com/blog/fossa-partners-with-npm-to-deliver-open-source-license-compliance/