Retire.js

Retire.js is a free software composition analysis tool for JavaScript. It detects browser libraries and Node.js modules with known vulnerabilities, including copied files that never appear in a package manifest.

The project provides a command-line scanner, Chrome extension, CycloneDX output, and integrations for web testing tools. It is licensed under Apache 2.0.

What is Retire.js?

Retire.js compares detected JavaScript libraries and versions with its vulnerability repository. This covers Node.js modules and libraries committed directly into a web application’s source tree.

Retire.js matters to me for the copied-library case: vulnerable JavaScript can ship without appearing in a manifest.

Key features

Command-line scanner

The CLI scans the current web or Node.js application directory. The official README documents a global npm installation followed by a scan from the project root:

npm install -g retire
retire

Node.js and npm are prerequisites. Retire.js does not require an account or hosted service for this workflow.

By default, the process exits with code 13 when it finds a vulnerability. --exitwith 0 overrides that result, though doing so removes the default failure signal used by automated checks.

The source-tree and browser modes inspect different inputs. The CLI scans project files, while the extension observes libraries loaded by a visited page.

CycloneDX SBOM output

Retire.js can write detected libraries in CycloneDX format:

retire --outputformat cyclonedx

This is inventory output from the libraries Retire.js detects. The CLI documentation does not list license analysis, reachability analysis, or automated dependency upgrades.

Browser and proxy integrations

The Chrome extension checks visited pages for insecure libraries. It reports warnings in the developer console and changes its address-bar icon when it detects an affected library.

The project says the Chrome extension is not officially listed in the Chrome Web Store. Its Firefox extension is deprecated and needs a new maintainer.

The Chrome extension documentation says the default build can invoke library-detection functions inside a sandboxed iframe. The repository also provides an extension-no-func build that does not invoke those functions.

The Retire.js README links to a Burp extension whose own documentation was last updated in December 2019. ZAP maintains a separate Retire.js add-on that passively identifies outdated or vulnerable JavaScript packages.

A separate retire-site-scanner repository provides headless website scanning. The Grunt plugin and Gulp task documented by the project are deprecated.

Detection scope

Retire.js is deliberately narrow. It focuses on JavaScript libraries and Node.js modules rather than scanning every package ecosystem or application code for custom vulnerabilities.

The vulnerability repository is published as JSON and powers the project’s public database page. A detected version is matched against the affected version ranges stored there.

The scope includes supported browser libraries copied into static assets. Projects with other package ecosystems need additional inventory sources.

Retire.js does not provide reachability analysis or automated upgrades. It identifies the affected library and version; remediation remains a package or asset update in the application.

The scanner is also narrower than a JavaScript SAST tool. It checks known library vulnerabilities rather than custom data flows or application-specific coding mistakes.

Project status

The Retire.js repository was created in August 2013 and remains active. Release 5.4.3 was published on May 26, 2026.

The project uses the Apache 2.0 license. Its vulnerability database and scanner are maintained in the same GitHub organization.

When to use Retire.js

Retire.js fits projects with browser-side JavaScript copied into source control or legacy assets that package-lock scanners miss. It is also a small CI check for Node.js applications.

How does Retire.js fit into a pipeline?

Retire.js works best as a narrow dependency gate. The CLI documentation supports severity thresholds, custom exit codes, ignore files, local repositories, and CycloneDX output.

I would roll it out in four steps:

1. Scan the repository locally and review every detected library and version.
2. Record justified exceptions in .retireignore.json instead of forcing a zero exit.
3. Fail CI only at the severity threshold the team can respond to.
4. Export CycloneDX when another system owns inventory or reporting.

For deployed pages, the project’s headless site scanner covers libraries loaded at runtime. That complements the source-tree scan without turning Retire.js into a general DAST product.

How is Retire.js released and licensed?

Retire.js 5.4.3 was released on May 26, 2026. The repository history shows maintenance through small scanner and vulnerability-database releases rather than a hosted service.

The project uses the Apache 2.0 license . The CLI runs locally with Node.js and npm, without an account.

Teams should still pin the npm package version in CI. Updating the scanner and its vulnerability data on a planned cadence makes changes to findings reviewable.

What are Retire.js’s limitations?

Retire.js only covers JavaScript libraries and Node.js modules represented in its detection repository. Other ecosystems, unknown libraries, and custom application vulnerabilities are outside its scope.

Detection is version-based, not reachability-based. A reported library can be unused in the vulnerable path, while an obfuscated or modified copy can be difficult to identify correctly.

The tool does not provide license policy, automated upgrades, owner routing, or a hosted remediation workflow. Those jobs require another SCA platform or internal automation.

Browser integrations also have maintenance constraints. The official README says the Chrome extension is not in the Web Store and the Firefox extension is deprecated.

Frequently Asked Questions