LicenseTrace

Inspiration

I didn't know this was possible until I went down a rabbit hole: a single package buried deep in your dependency tree can legally force your private code open source. Not your code — something you've never heard of, four or five layers down, that came along for the ride when you installed something else.

The story that got me was Gatsby. Teams using it suddenly had their builds break one day — no code change, nothing they did. The culprit was a GPL package called smartwrap, pulled in deep by a tiny upstream update. Nobody knew they depended on it (Goldman Sachs wrote it up as "The Mystery of the Disappearing NPM Dependency"). And it's cost real money — Orange got ordered to pay over €900,000, Panasonic's facing a $100M suit, all over this kind of thing.

What got me was that every existing tool just lists the licenses you have. None of them show you the path — how a buried package actually reaches your code. That felt like the whole point, and nobody was doing it.

What it does

You point LicenseTrace at a dependency tree and it traces every hop, however deep, to find buried copyleft packages — then proves the exact chain from your app down to the one that contaminates you. Not "here are your licenses," but "here's the specific path that legally reaches you."

Every finding is backed by real sources it pulls live — the package's license page, the license definition, the documented incident — and written out to a cited report. You can also scan any live npm package and watch it pull the real dependency tree on the spot.

The core idea: this is a reachability problem, not a lookup. So it runs on a reasoning engine that proves the path, instead of a script that lists what's there.

How I built it

The reasoning runs on Prometheux. I wrote the contamination rule in plain terms — if a proprietary app can reach a copyleft package down its tree, it's contaminated, and show the full path — and Prometheux derives and proves that path live over the dependency graph.

Tavily fetches the real web sources for each finding, so the citations are actually retrieved, not hardcoded. ClickHouse logs every scan. deps.dev gives me real dependency and license data for scanning live npm packages. The whole thing is a single-page app over a small Node server that keeps the keys server-side.

When it works end to end, it's genuinely live: you scan, Prometheux reasons over the graph, and the contamination path lights up red while it pulls the sources.

Challenges I ran into

Getting Prometheux to genuinely run my reasoning live was the hardest part of the day. The API endpoint wasn't documented, so I had to find it, get auth working, and figure out how to feed my data into a saved concept — with a local fallback so the demo could never just freeze on stage.

Real dependency data is also way messier than the clean examples — cycles, the same package at different versions, trees with over a thousand nodes. I had to make the traversal cycle-safe and prioritise keeping the copyleft packages when capping big trees, so a contamination chain never gets cut off by accident.

And I grounded the whole thing in the real Gatsby incident on purpose — I didn't want to demo invented data and claim it was real.

What I learned

That copyleft risk is really a path problem — the danger isn't which licenses exist, it's which buried package can quietly reach your code, and how. I also learned that a reasoning engine is genuinely the right tool here: it proves reachability instead of pattern-matching a list. And the slightly unsettling bit — most packages really are clean, which is exactly why the rare contaminated one slips through. Nobody's looking.

Built with

Prometheux · Tavily · ClickHouse · deps.dev · Node.js · JavaScript

Built With

• clickyhouse
• node.js
• prometheux
• travily