npm-scan. Honest licensing.

ROI vs. Attack Cost. A single supply chain breach from a malicious npm package can cost $100k–$5M+ in incident response, legal liability, reputation damage, and downtime. npm-scan at $799–$9,900/year pays for itself 12–625x over if it prevents even one incident. When a typosquatted dependency or infostealer reaches production, the cleanup cost dwarfs any licensing fee. This isn't academic — it's the math of modern software defense.

Legal & Compliance Protection. Licensed open source provides the documentation and clarity that enterprise audits demand: clear legal documentation for audit trails, liability clarity through a legitimate paid tool, compliance evidence for SOC 2, ISO 27001, FedRAMP, and customer security reviews, and defensibility in breach post-mortems — "we invested in detection tools" is a stronger position than "we relied on free software."

Why Legal Departments Prefer Licensed Open Source. Paid licensing eliminates ambiguity around usage rights. The Business License Agreement provides explicit legal protection and demonstrates due diligence to insurers and regulators. It also reduces supply chain risk itself — you're not depending on unpaid volunteer maintenance for your security infrastructure. An auditable vendor relationship replaces "free tool nobody is responsible for" with a contract holder who has obligations.

Additional Business Benefits. Email support included means faster resolution than GitHub issues. Vendor accountability means you have a contract, not a hope. Enterprise credibility proves you invest in infrastructure. And sustainable maintenance funding keeps npm-scan updated against new threats — because attackers don't stop innovating, and neither should your defenses.