Turn an npm lockfile into a reviewable notice draft.

Compare local package metadata, classify exact license declarations with your policy, attach local LICENSE or NOTICE text and export an evidence ZIP. No package is executed and no registry, repository or URL is contacted.

NPM PACKAGE-LOCK V2/V3 ONLY UP TO 50,000 PACKAGE ENTRIES 100 LOCAL EVIDENCE FILES / 15 MIB

Import release evidence

Both npm files are required. LICENSE and NOTICE text is optional.

package.json One UTF-8 manifest, up to 2 MiB. package-lock.json lockfileVersion 2 or 3, up to 20 MiB.

Optional local LICENSE / NOTICE files UTF-8 text only, 2 MiB each and 15 MiB total. Files are mapped to packages after parsing; unassigned files remain project evidence.

Exact declaration policy

One declaration per line or comma. Matching is exact and case-insensitive; SPDX expressions are not interpreted. You can override each package decision later.

Allow Review Deny

No npm release files selected.

Selected manifest, lockfile and evidence content is processed in this page and is not sent to a WebRynx application endpoint. Package code is not executed and source files are not modified.

No inventory yet. Choose the two npm files or load the built-in sample.

Dependency review

Every package remains visible, including missing and unlisted licenses.

Parsing and policy findings

Package decisions

Package	Version	Declared license	Scope	Policy	Review decision

Local evidence mapping

Map each supplied file to one exact package and version, or leave it as unassigned project evidence. Filename guesses are suggestions only.

File	Kind	Package

Draft release pack

The ZIP contains THIRD_PARTY_NOTICES, inventory JSON/CSV, decisions, policy, supplied evidence and a hash receipt. It is a review draft, not legal advice, a compliance conclusion or a certificate.