Package ships no license file and its upstream repository
(https://github.com/kemitchell/spdx-exceptions.json) contains none.

The "Copyright and Licensing" section of the package's own README is the authoritative notice
for the declared CC-BY-3.0 license; it is reproduced here verbatim from
node_modules/spdx-exceptions/README.md.