Skip to content
SPECIFICTION
Get listed

Retire.js

retirejs.github.io

Free plan WebWindowsmacOSLinuxAPISelf-hosted
Visit retirejs.github.io
Spec score 8.2 #14 of 65 in Software Composition Analysis Software

What it is

Retire.js detects JavaScript library versions with known vulnerabilities, including libraries stored directly in source control. Its command-line scanner checks web apps and Node.js projects for vulnerable libraries and Node.js modules, and requires Node.js and npm to install and run. By default, the CLI exits with code 13 when it finds vulnerabilities; its behavior can be changed with `--exitwith 0`. Chrome and Firefox extensions scan visited sites and report insecure libraries in the developer console and browser toolbar. The Chrome extension is not officially available in the Chrome Web Store, and the Firefox extension is deprecated. Retire.js also has a Burp extension and an OWASP ZAP add-on, while retire-site-scanner supports headless website scanning. It can generate CycloneDX SBOM output, including JSON formats and versions with a vulnerabilities section. The Grunt plugin and Gulp task are also marked deprecated. Retire.js is free and is distributed under Apache License 2.0.

Spec sheet

Purpose
Retire.js detects JavaScript library versions with known vulnerabilities, including libraries that are not listed in package manifests.Read 12 Oct 2026 · github.com
Integrations
Retire.js has a Burp plugin and an OWASP ZAP add-on; ZAP officially supports its add-on and includes it in weekly releases.Read 12 Oct 2026 · github.com
License
The project is published under the Apache-2.0 license.Read 12 Oct 2026 · github.com
Browser availability
The README says the Chrome extension is not officially available in the Chrome Web Store and the Firefox extension is deprecated.Read 11 Oct 2026 · github.com
Browser extensions
Chrome and Firefox extensions scan visited sites and show warnings in the developer console and browser toolbar.Read 11 Oct 2026 · github.com
Browser scanning
The browser extensions scan visited sites and report insecure libraries in the developer console and through an address-bar icon.Read 12 Oct 2026 · github.com
Chrome status
The Chrome extension is not officially available in the Chrome Web Store.Read 12 Oct 2026 · github.com
CLI scanning
The command-line scanner scans web apps and Node.js projects for vulnerable JavaScript libraries and Node.js modules.Read 12 Oct 2026 · github.com
Command-line scanner
The command-line scanner checks web apps and Node.js apps for vulnerable JavaScript libraries and Node.js modules.Read 11 Oct 2026 · github.com
Deprecated integrations
The Grunt plugin and Gulp task are marked deprecated.Read 12 Oct 2026 · github.com
Detection limit
The README says the Firefox extension is deprecated and asks for a maintainer to resume its development.Read 11 Oct 2026 · github.com
Firefox status
The Firefox extension is marked deprecated, and the maintainers invite someone to maintain it.Read 12 Oct 2026 · github.com
Funding
The project says donations fund maintenance of the tool and vulnerability repository.Read 12 Oct 2026 · github.com
Headless scanning
The retire-site-scanner project can scan websites in headless mode.Read 12 Oct 2026 · github.com
Maintainer
The project site identifies Erlend Oftedal as a maintainer.Read 11 Oct 2026 · retirejs.github.io
Other deprecated integrations
The README marks the Grunt plugin and Gulp task as deprecated.Read 11 Oct 2026 · github.com
Runtime requirement
The command-line scanner requires Node.js and npm to install and run.Read 12 Oct 2026 · github.com
SBOM
Retire.js can generate CycloneDX SBOMs in XML and JSON, including newer JSON formats with vulnerability sections.Read 12 Oct 2026 · github.com
Support and contributions
The project README invites users to contribute to the scanner and vulnerability repository and says donations fund their maintenance.Read 11 Oct 2026 · github.com
Vulnerability exit behavior
By default, the command-line scanner exits with code 13 when it finds vulnerabilities, and its documentation says this can be overridden with --exitwith 0.Read 12 Oct 2026 · github.com

Plans and prices

Retire.js Free Open-source scanner and related tools Read 12 Oct 2026 · github.com

Every Retire.js plan and price →

Strong points and limits

Strong points

  • Scans web apps and Node.js projects.
  • Includes Burp and OWASP ZAP integrations.
  • Supports headless website scanning.
  • Can generate CycloneDX SBOM output.
  • Free under Apache License 2.0.

Limits

  • CLI requires Node.js and npm.
  • Firefox extension is deprecated.
  • Chrome extension is not officially in the Chrome Web Store.
  • Grunt and Gulp integrations are deprecated.

Who it suits

Retire.js suits developers and security teams checking JavaScript and Node.js projects for known vulnerable libraries. It may also fit teams that want browser scans, headless scans or CycloneDX SBOM output.

Verdict

Retire.js offers command-line, browser and integration-based scanning, plus SBOM generation, at no listed charge. Check the deprecated extension and plugin status before relying on those components.

Where Specifiction places it

Alternatives to Retire.jsAll alternatives →