Retire.js is a free software composition analysis tool for JavaScript. It detects browser libraries and Node.js modules with known vulnerabilities, including copied files that never appear in a package manifest.
The project provides a command-line scanner, Chrome extension, CycloneDX output, and integrations for web testing tools. It is licensed under Apache 2.0.
What is Retire.js?
Retire.js compares detected JavaScript libraries and versions with its maintained vulnerability repository. This covers dependencies installed through Node.js and libraries committed directly into a web application’s source tree.
That second case is the reason the project exists. A copied library can be in production without appearing in package.json, a lockfile, or another package inventory.
Key features
| Feature | Details |
|---|---|
| Source-tree scanning | Finds vulnerable JavaScript files stored with application code |
| Node.js scanning | Checks Node.js modules used by the project |
| Vulnerability repository | Uses the Retire.js JavaScript vulnerability database |
| CycloneDX output | Generates a CycloneDX SBOM from detected libraries |
| Exit behavior | Returns code 13 by default when vulnerabilities are found |
| Browser checking | Chrome extension scans libraries loaded by visited pages |
| Proxy integrations | Available through Burp and the official OWASP ZAP add-on |
Command-line scanner
The CLI scans the current web or Node.js application directory. The official README documents a global npm installation followed by a scan from the project root:
npm install -g retire
retire
Node.js and npm are prerequisites. Retire.js does not require an account or hosted service for this workflow.
By default, the process exits with code 13 when it finds a vulnerability. --exitwith 0 overrides that result, though doing so removes the default failure signal used by automated checks.
The source-tree and browser modes answer different questions. The CLI finds files present in the project, while the extension observes libraries loaded by a visited page.
Run both when build steps rename, bundle, or copy assets before deployment. A difference between the two inventories can reveal code that exists only before or after the build.
CycloneDX SBOM output
Retire.js can write detected libraries in CycloneDX format:
retire --outputformat cyclonedx
This is inventory output from the libraries Retire.js detects. The project does not claim license analysis, reachability analysis, or automated dependency upgrades.
Browser and proxy integrations
The Chrome extension checks visited pages for insecure libraries. It reports warnings in the developer console and changes its address-bar icon when it detects an affected library.
The project says the Chrome extension is not officially listed in the Chrome Web Store. Its Firefox extension is deprecated and needs a new maintainer.
Retire.js is also available through a Burp extension and an OWASP ZAP add-on. The ZAP team supports its add-on and includes it in weekly ZAP releases.
A separate retire-site-scanner repository provides headless website scanning. The Grunt plugin and Gulp task documented by the project are deprecated.
Detection scope
Retire.js is deliberately narrow. It focuses on JavaScript libraries and Node.js modules rather than scanning every package ecosystem or application code for custom vulnerabilities.
The vulnerability repository is published as JSON and powers the project’s public database page. A detected version is matched against the affected version ranges stored there.
This works well for old browser libraries copied into static assets. It is less complete than a multi-ecosystem SCA platform when JavaScript is only one part of a larger stack.
Retire.js does not provide reachability analysis or automated upgrades. It identifies the affected library and version; remediation remains a package or asset update in the application.
The scanner is also narrower than a JavaScript SAST tool. It checks known library vulnerabilities rather than custom data flows or application-specific coding mistakes.
Project status
Retire.js began in 2013 and remains active. Release 5.4.3 was published in May 2026, and the repository had 4,154 GitHub stars when this page was updated.
The project uses the Apache 2.0 license. Its vulnerability database and scanner are maintained in the same GitHub organization.
When to use Retire.js
Retire.js fits projects with browser-side JavaScript copied into source control or legacy assets that package-lock scanners miss. It is also a small CI check for Node.js applications.
Frequently Asked Questions
What does Retire.js scan?
Is Retire.js free?
Can Retire.js generate an SBOM?
retire --outputformat cyclonedx. Vulnerability findings still cause exit code 13 by default.