Retire.js
What it is
Retire.js is a free scanner for JavaScript libraries and Node.js modules with known vulnerabilities. Its command-line tool scans web apps and Node.js projects, including libraries kept directly in source control, and requires Node.js and npm to install and run. By default, the scanner exits with code 13 when it finds vulnerabilities; this behavior can be changed with the `--exitwith 0` option. Chrome and Firefox extensions check visited sites and report insecure libraries through the developer console and browser toolbar. The Chrome extension is not officially available in the Chrome Web Store, and the Firefox extension is deprecated. Other options include a Burp extension, an OWASP ZAP add-on, headless website scanning through retire-site-scanner, and CycloneDX SBOM output in JSON formats. The Grunt plugin and Gulp task are marked deprecated. The project is distributed under Apache License 2.0, which grants a no-charge, royalty-free license subject to its terms.
For and against
For
- Scans web apps and Node.js projects.
- Can detect libraries stored in source control.
- Generates CycloneDX SBOM output.
- Offers Burp and OWASP ZAP integrations.
- Free under Apache License 2.0 terms.
Against
- The CLI requires Node.js and npm.
- The Firefox extension is deprecated.
- The Chrome extension is not officially in its store.
- The Grunt and Gulp integrations are deprecated.
The verdict
Retire.js provides command-line, browser, integration, and SBOM options for vulnerability detection in JavaScript projects. Note the installation requirements and deprecated browser or build-tool components when selecting how to use it.
Who it suits
It suits developers and security teams looking to scan web apps or Node.js projects for known vulnerable libraries. Teams can also use its browser extensions, integrations, headless scanner, or SBOM generation where those fit their workflow.
Plans and prices
Retire.js
Open-source scanner and related tools
Read 12 Oct 2026 · github.com
On the record
- Browser availability
- The README says the Chrome extension is not officially available in the Chrome Web Store and the Firefox extension is deprecated.github.com · read 11 Oct 2026
- Browser extensions
- Chrome and Firefox extensions scan visited sites and show warnings in the developer console and browser toolbar.github.com · read 11 Oct 2026
- Browser scanning
- The browser extensions scan visited sites and report insecure libraries in the developer console and through an address-bar icon.github.com · read 12 Oct 2026
- Chrome status
- The Chrome extension is not officially available in the Chrome Web Store.github.com · read 12 Oct 2026
- CLI scanning
- The command-line scanner scans web apps and Node.js projects for vulnerable JavaScript libraries and Node.js modules.github.com · read 12 Oct 2026
- Command-line scanner
- The command-line scanner checks web apps and Node.js apps for vulnerable JavaScript libraries and Node.js modules.github.com · read 11 Oct 2026
- Deprecated integrations
- The Grunt plugin and Gulp task are marked deprecated.github.com · read 12 Oct 2026
- Detection limit
- The README says the Firefox extension is deprecated and asks for a maintainer to resume its development.github.com · read 11 Oct 2026
- Firefox status
- The Firefox extension is marked deprecated, and the maintainers invite someone to maintain it.github.com · read 12 Oct 2026
- Funding
- The project says donations fund maintenance of the tool and vulnerability repository.github.com · read 12 Oct 2026
- Headless scanning
- The retire-site-scanner project can scan websites in headless mode.github.com · read 12 Oct 2026
- Integrations
- Retire.js has a Burp plugin and an OWASP ZAP add-on; ZAP officially supports its add-on and includes it in weekly releases.github.com · read 12 Oct 2026
- License
- The project is published under the Apache-2.0 license.github.com · read 12 Oct 2026
- Maintainer
- The project site identifies Erlend Oftedal as a maintainer.retirejs.github.io · read 11 Oct 2026
- Other deprecated integrations
- The README marks the Grunt plugin and Gulp task as deprecated.github.com · read 11 Oct 2026
- Purpose
- Retire.js detects JavaScript library versions with known vulnerabilities, including libraries that are not listed in package manifests.github.com · read 12 Oct 2026
- Runtime requirement
- The command-line scanner requires Node.js and npm to install and run.github.com · read 12 Oct 2026
- SBOM
- Retire.js can generate CycloneDX SBOMs in XML and JSON, including newer JSON formats with vulnerability sections.github.com · read 12 Oct 2026
