RetireJS/retire.js

Health v2 · maintenance only

Adoption not part of the score

4161 stars · 438 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Retire.js is a scanner that detects the use of JavaScript libraries and Node.js modules with known vulnerabilities, available as a CLI scanner, browser extensions, and plugins for Burp and OWASP ZAP. It can also generate SBOMs in CycloneDX format (XML and JSON, including VEX variants).

Use cases

• scan a node app for vulnerable javascript libraries
• detect insecure js libraries loaded on websites
• generate a cyclonedx sbom of javascript dependencies
• find js libraries with known cves not listed in package manifests
• integrate vulnerability scanning into ci pipeline
• check web apps for outdated frontend libraries

When to choose

• you need to detect vulnerable JavaScript libraries even when they are not declared in package manifests
• you want an SBOM generator for JS dependencies in CycloneDX format
• you need a scanner that works as CLI, browser extension, or Burp/ZAP plugin

When to avoid

• you need full SCA for non-JavaScript ecosystems like Python or Java
• you want a maintained Firefox extension (it is deprecated)
• you need continuous dependency monitoring with dashboards rather than on-demand scanning

Facets

cli-tool · maturity active

security vulnerability-scanning developer-tools cli security web-development developer-tools cli browser-extension cross-platform sbom software-composition-analysis vulnerable-libraries owasp cyclonedx burp-extension zap-addon chrome-extension javascript nodejs

Member repositories

For agents

markdown · JSON · MCP: product_card(name="RetireJS/retire.js")