FossID Workbench vs Retire.js

FossID Workbench is a software composition analysis tool for identifying and governing third-party software in codebases. It analyzes direct and transitive dependencies, scans unmanaged source code across programming languages, and detects embedded open-source snippets, including modified code. ID Assist proposes component identifications, while License Extractor extracts file-level license text. Vulnerable Snippet Finder locates code blocks linked to CVEs, with VEX data adding exploitability context. Workbench creates, imports, consolidates, and exports software bills of materials with component, license, vulnerability, and usage information in SPDX or CycloneDX formats. Policy Management can enforce license, security, and usage rules across projects. GitHub, GitLab, and Bitbucket imports are supported, alongside CI/CD scanning, gating, pull-request notifications, and API workflows. Deployment options include cloud, hybrid, on-premises, and offline air-gapped setups. It supports many ecosystems, including JavaScript, Java/Kotlin, Python, Rust, Go, C/C++, .NET, and others. Pricing is available on request.

Retire.js detects JavaScript library versions with known vulnerabilities, including libraries stored directly in source control. Its command-line scanner checks web apps and Node.js projects for vulnerable libraries and Node.js modules, and requires Node.js and npm to install and run. By default, the CLI exits with code 13 when it finds vulnerabilities; its behavior can be changed with `--exitwith 0`. Chrome and Firefox extensions scan visited sites and report insecure libraries in the developer console and browser toolbar. The Chrome extension is not officially available in the Chrome Web Store, and the Firefox extension is deprecated. Retire.js also has a Burp extension and an OWASP ZAP add-on, while retire-site-scanner supports headless website scanning. It can generate CycloneDX SBOM output, including JSON formats and versions with a vulnerabilities section. The Grunt plugin and Gulp task are also marked deprecated. Retire.js is free and is distributed under Apache License 2.0.