Earlier quoted context omitted.
This is one reason I hate npm. Who really checks that sprawling byzantine dependency tree to make sure that there isn't some micropackage that has a GPL license that could get included and taint the whole thing? I just have the horrors when I look at the package.json file after the front-end folks have been allowed to run free...
Shouldn't you be more concerned about the quality of the code? If no one has bothered to check the license, I'm sure nobody has studied it for a backdoor.
Most of the time, nobody even is aware that including some new widget code ends up downloading half the internet, making our code size increase, our build times extend, and opening up a huge volume of attack. No one has any idea what dragons might lurk in that mess, or sometimes even that there might be dragons at all.