Retire.js vs Scantist
Retire.js
retirejs.github.io
Scantist
scantist.comSide by side
| Figure | Retire.js | Scantist |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | Yes |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | — |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 12 |
| Spec score · Software Composition Analysis Software | 8.2 (#14) | 8.6 (#7) |
| Integrations | Retire.js has a Burp plugin and an OWASP ZAP add-on; ZAP officially supports its add-on and includes it in weekly releases. | The pricing matrix lists CI/CD integrations including Jenkins, GitHub Actions and GitLab, plus cloud source-control integrations and premium chat integrations. |
Plans
Scantist
- AppDefender FreeFree
- Basic$200, paid once
- PAIStrike Basic$200, paid once
- PAIStrike Pro$450, paid once
- Pro$450, paid once
- Max$1,275, paid once
- PAIStrike Max$1,275, paid once
- AppDefender BasicPriced on request
- AppDefender EnterprisePriced on request
- AppDefender PremiumPriced on request
In their own words
Retire.js
Retire.js detects JavaScript library versions with known vulnerabilities, including libraries stored directly in source control. Its command-line scanner checks web apps and Node.js projects for vulnerable libraries and Node.js modules, and requires Node.js and npm to install and run. By default, the CLI exits with code 13 when it finds vulnerabilities; its behavior can be changed with `--exitwith 0`. Chrome and Firefox extensions scan visited sites and report insecure libraries in the developer console and browser toolbar. The Chrome extension is not officially available in the Chrome Web Store, and the Firefox extension is deprecated. Retire.js also has a Burp extension and an OWASP ZAP add-on, while retire-site-scanner supports headless website scanning. It can generate CycloneDX SBOM output, including JSON formats and versions with a vulnerabilities section. The Grunt plugin and Gulp task are also marked deprecated. Retire.js is free and is distributed under Apache License 2.0.