See https://github.com/nexB/scancode-toolkit/blob/41d2d5b4e9284505b39691c3f21b85ab7dc16772/src/packagedcode/npm.py#L109
... We could skip npm licenses if the declared license is not a string or mapping
We need a third case there, otherwise there is a possibility that we would silently not detect a license (we would still report that as a declared license alright)