ComplyVigilance SCA vs Retire.js
ComplyVigilance SCA
complyvigilance.comRetire.js
retirejs.github.ioSide by side
| Figure | ComplyVigilance SCA | Retire.js |
|---|---|---|
| Price from | €10/mo | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | — | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 4 | 1 |
| Spec score · Software Composition Analysis Software | 8.3 (#10) | 8.2 (#14) |
| Integrations | CI/CD integrations are included in Foundation and higher tiers; API and SIEM integrations are listed for Enterprise. | Retire.js has a Burp plugin and an OWASP ZAP add-on; ZAP officially supports its add-on and includes it in weekly releases. |
| SBOM | SBOM generation supports CycloneDX 1.5+, SPDX 2.3, and VEX formats, and the product also supports importing external SBOMs. | Retire.js can generate CycloneDX SBOMs in XML and JSON, including newer JSON formats with vulnerability sections. |
Plans
ComplyVigilance SCA
- FreeFree
- Foundation€120 a year
- Professional€200 a year
- EnterprisePriced on request
In their own words
ComplyVigilance SCA
ComplyVigilance SCA has no write-up on Specifiction yet; its figures are above.
Retire.js
Retire.js detects JavaScript library versions with known vulnerabilities, including libraries stored directly in source control. Its command-line scanner checks web apps and Node.js projects for vulnerable libraries and Node.js modules, and requires Node.js and npm to install and run. By default, the CLI exits with code 13 when it finds vulnerabilities; its behavior can be changed with `--exitwith 0`. Chrome and Firefox extensions scan visited sites and report insecure libraries in the developer console and browser toolbar. The Chrome extension is not officially available in the Chrome Web Store, and the Firefox extension is deprecated. Retire.js also has a Burp extension and an OWASP ZAP add-on, while retire-site-scanner supports headless website scanning. It can generate CycloneDX SBOM output, including JSON formats and versions with a vulnerabilities section. The Grunt plugin and Gulp task are also marked deprecated. Retire.js is free and is distributed under Apache License 2.0.