Bomly CLI vs Retire.js
Bomly CLI
bomly.devRetire.js
retirejs.github.ioSide by side
| Figure | Bomly CLI | Retire.js |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | — | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | — | Yes |
| Plans published | 1 | 1 |
| Spec score · Software Composition Analysis Software | 8.2 (#11) | 8.2 (#14) |
| Purpose | Bomly scans source trees, SBOMs, Git refs, and container images to build dependency graphs and explain why packages are present. | Retire.js detects JavaScript library versions with known vulnerabilities, including libraries that are not listed in package manifests. |
Plans
In their own words
Retire.js
Retire.js detects JavaScript library versions with known vulnerabilities, including libraries stored directly in source control. Its command-line scanner checks web apps and Node.js projects for vulnerable libraries and Node.js modules, and requires Node.js and npm to install and run. By default, the CLI exits with code 13 when it finds vulnerabilities; its behavior can be changed with `--exitwith 0`. Chrome and Firefox extensions scan visited sites and report insecure libraries in the developer console and browser toolbar. The Chrome extension is not officially available in the Chrome Web Store, and the Firefox extension is deprecated. Retire.js also has a Burp extension and an OWASP ZAP add-on, while retire-site-scanner supports headless website scanning. It can generate CycloneDX SBOM output, including JSON formats and versions with a vulnerabilities section. The Grunt plugin and Gulp task are also marked deprecated. Retire.js is free and is distributed under Apache License 2.0.