Simple npm license clarity is not reported correctly

[pombredanne]

See attached. Adding pkg:npm/%40swc/core-darwin-arm64@1.11.18 as a package, the declared license is detected correctly, but the license clarity is not.

Download URL: https://registry.npmjs.org/@swc/core-darwin-arm64/-/core-darwin-arm64-1.11.18.tgz

[tdruez]

DejaCode displays data as provided by ScanCode.io (powered by ScanCode-toolkit).
If the presented values seem wrong, this is likely an issue on the toolkit side.

$ scancode --json-pp - --info --summary --license --license-text --package --classify --license-clarity-score core-darwin-arm64-1.11.18.tgz-extract/

...
"summary": {
    "declared_license_expression": "apache-2.0 AND mit",
    "license_clarity_score": {
      "score": 0,
      "declared_license": false,
      "identification_precision": false,
      "has_license_text": false,
      "declared_copyrights": false,
      "conflicting_license_categories": false,
      "ambiguous_compound_licensing": true
    },
...

Moving the ticket to the scancode-toolkit repo for action.

[AyanSinhaMahapatra]

This is essentially tracked in:

• Look in package-ecosystem specific key-files for referenced licenses and summary #3707
• Improve License Clarity at Top Package Level #3792

Because the npm package has a structure where there is a package directory in the downloaded package and all the key-files are present there. The way we currently compute the clarity score and summary is closely based on key files present at the root of the downloaded package and this fails when the key files are present not at the root, but some other ecosystem specific structure or directory (or you initiate the scan with a input directory which is not the directory where the key files are present).

To fix this we are implementing at #3792 to:

• check for key files in ecosystem specific places (or by default check next to the package manifests)
• compute the summary and clarity score from these

[swastkk]

Right @AyanSinhaMahapatra, this was due the fact that the top level resources were not considered for the npm ecosystem currently, and so then the licence_clarity_score was 0.
After getting the top level resources for npm packages
scan results

"summary": {
    "declared_license_expression": "apache-2.0 AND mit",
    "license_clarity_score": {
      "score": 80,
      "declared_license": true,
      "identification_precision": true,
      "has_license_text": false,
      "declared_copyrights": false,
      "conflicting_license_categories": false,
      "ambiguous_compound_licensing": false
    },
    "declared_holder": "",
    "primary_language": "JavaScript",
    "other_license_expressions": [
      {
        "value": null,
        "count": 2
      },
      {
        "value": "apache-2.0",
        "count": 1
      }
    ],
    "other_holders": [],
    "other_languages": []
  },

[Shaurya-dev7]

Hi everyone 👋

I spent some time investigating this issue and reviewing the related discussions/issues around npm top-level resource handling and license clarity scoring.

From the issue discussion and the recent comments, it seems the root cause is that top-level npm package resources are not properly considered during license clarity evaluation. Because of this, fields like declared_license, identification_precision, and ambiguous_compound_licensing end up producing an incorrect score.

I’ve already started reproducing the issue locally using the provided package:

pkg:npm/%40swc/core-darwin-arm64@1.11.18

and tracing the related package/license processing flow. I’m also reviewing the changes/discussions linked from:

• Look in package-ecosystem specific key-files for referenced licenses and summary #3707
• Improve License Clarity at Top Package Level #3792

to better understand where the npm top-level resource handling should be integrated into the license clarity computation pipeline.

My plan is to:

• reproduce the incorrect score behavior consistently,
• identify the exact point where npm top-level resources are skipped,
• add/update tests for this package scenario,
• and submit a focused fix for the clarity scoring logic.

If nobody is actively working on this right now, I’d love to take this up and contribute a proper fix 🚀