There is a license field in package.json. If you use npm init to generate that file, it will validate the option you choose against a list of known licenses.

There is a license field in package.json. If you use npm init to generate that file, it will validate the option you choose against a list of known licenses. So far as I know, if you write your own package.json, there is no requirement to have a license field. Even if you use npm init, you can choose "UNLICENSED". I don't know off the top of my head if they have anything in their terms of use about the rights to permanently distribute published copies; I only know what the tooling enforces.