It's a GPL library, which is a copyleft license that actually predates the usage of the term "open source". Just because it's on npm/github doesn't mean you don't need to check the type of license.