What NPM should do to stop a new colors attack

Re:What NPM should do to stop a new colors attack by peoplefromibiza on Monday January 10, 2022 @04:24PM (#29882786)

I don't know in this case but in general a GPL fork must stay GPL and, AFAIUI, importing a GPL package in your code it's similar to linking to it, so if the code that uses your GPL package is published (on GH for example) that could be considered redistribution. Not sure about the legalities but it could create enough friction to keep companies not willing to contribute away.

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by accoil on Monday January 10, 2022 @05:10PM (#29883477)

I guess I'm thinking more in terms of faker, which I believe was a library for creating test data. Makes me wonder if licenses matter much for tools that are never intended to be included in the final distribution.

Internal changes aren't going to be detectable, so it feels like the best you can hope for is that they don't want the maintenance burden of a patch set on top of your project. At that point it's not much different than MIT.

That said, AGPL would scare off most companies :p

[ Parent | on HN ]