attribution

Enforces that package.json declares author or contributor attribution.

✅ This rule is included in the package-json logical presets.

Package attribution identifies the people responsible for creating, maintaining, or contributing to a package. npm supports attribution through either the author property or the contributors property.

This rule enforces that public packages include author or a non-empty contributors.

Examples

❌ Incorrect

{}

{
  "contributors": []
}

✅ Correct

{
  "author": "Flint Contributors"
}

{
  "contributors": ["Flint Contributors"]
}

Options

ignorePrivate

Type: boolean

Default: true

Whether attribution requirements should be skipped when the package’s private property is true.

This option is useful for monorepos that contain private support packages that are never published.

packageJson.rules({
  attribution: {
    ignorePrivate: false,
  },
});

preferContributorsOnly

Type: boolean

Default: false

Whether only contributors should be accepted for package attribution.

This option is useful for projects that want all package attribution to use the same contributors shape.

packageJson.rules({
  attribution: {
    preferContributorsOnly: true,
  },
});

❌ Incorrect

{
  "author": "Flint Contributors"
}

✅ Correct

{
  "contributors": ["Flint Contributors"]
}

When Not To Use It

If package ownership is tracked outside package.json, such as in an internal service catalog or repository CODEOWNERS policy, this rule might not be for you.

If you already enable authorPresence or contributorsPresence, this rule is redundant and would double-report. Pick attribution when either property is acceptable, or pick the more specific rule when you want to require one in particular.

Equivalents in Other Linters

• ESLint: package-json/require-attribution