CheckOps home

Tools directory

R

CheckOps

Retire.js

Retire.js is an Apache-2.0 scanner that detects JavaScript libraries with known vulnerabilities in web apps and Node.js projects, and can generate an SBOM of the libraries it finds.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

Retire.js scans for JavaScript libraries with known vulnerabilities, a risk captured in the OWASP Top 10 as using components with known vulnerabilities. It works as a command-line scanner and as browser extensions, and can also generate an SBOM of the libraries it finds.

The source code is at RetireJS/retire.js on GitHub under the Apache-2.0 licence, with about 4,200 stars; the most recent commit was on 9 November 2026.

Features

  1. CLI scanner: Scan files and Node projects.
  2. Bundled library detection: Finds libraries copied into web assets.
  3. Browser extension: Detect vulnerable libraries on pages.
  4. SBOM output: CycloneDX output.
  5. Vulnerability repository: Community-maintained data.

Pros

  1. Free to use: Open source under Apache-2.0.
  2. Maintained: Commits as recent as 9 November 2026.
  3. Community: About 4,200 GitHub stars.

Cons

  1. JavaScript only: Single ecosystem.
  2. Signature-based: Unknown or modified libraries may be missed.
npm install -g retire
retire --path ./public

Resources:

Pricing

Retire.js is free and open source under the Apache-2.0 licence.

  1. Web teams with vendored front-end libraries.
  2. Security testers reviewing JS assets.
  3. Not a fit for server-side code in other languages.

Conclusion

Retire.js is a simple way to spot vulnerable JavaScript libraries, including bundled copies.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with Retire.js side by side.