Retire.js

Retire.js is a free, open-source vulnerability scanner for JavaScript libraries and Node.js modules. It is best suited to developers and security teams that want a self-hosted command-line check or an input to existing security tooling. Its CLI, headless scanner and CycloneDX export are useful strengths, but its browser and older build integrations need caution.

Overview

Retire.js identifies vulnerable versions of JavaScript libraries, including files checked directly into source control. The scope is deliberately focused: it addresses JavaScript and Node.js dependency risk rather than trying to be a complete software-composition-analysis suite. That makes it a practical addition to a JavaScript-oriented pipeline, while teams seeking broad ecosystem governance should consider a larger platform.

The project is distributed under Apache License 2.0, providing a no-charge, royalty-free license subject to its terms. It is self-hosted, and the command-line scanner requires Node.js and npm for installation and operation. The project welcomes contributions to both the scanner and vulnerability repository, while donations support maintenance.

Key features

Command-line checks

The CLI scans web applications and Node.js projects for vulnerable libraries and Node.js modules. Its default exit code is 13 when vulnerabilities are found, which is a useful failure signal for automated jobs. Documentation says --exitwith 0 can override that behavior, so teams that want reporting without stopping a script can adapt it.

Browser and headless scanning

Chrome and Firefox extensions inspect visited sites and report insecure libraries in the developer console and browser toolbar. Their current status limits how dependable this route is: the Chrome extension is not officially offered through the Chrome Web Store, and the Firefox extension is deprecated, with maintainers seeking someone to resume development. For repeatable website checks, the retire-site-scanner project provides headless scanning and is a more suitable fit for automation.

Security-tool integrations

A Burp extension and an OWASP ZAP add-on let security testing workflows incorporate Retire.js findings. The ZAP team supports its add-on and includes it in weekly releases, making ZAP the stronger integration choice. By contrast, the Grunt plugin and Gulp task are marked deprecated, so new build pipelines should not rely on them.

SBOM output

Retire.js can generate CycloneDX software bills of materials, including JSON output and variants that include a vulnerabilities section. This is valuable when a team needs a machine-readable inventory for downstream review or compliance processes, without adopting a separate inventory generator.

Pricing

Retire.js — free: The open-source scanner and related tools are free to use under Apache License 2.0. There are no paid tiers, seat charges or stated usage quotas. In exchange, users take responsibility for running the tooling themselves and may need to contribute or donate if they want to support ongoing maintenance.

Platforms

Retire.js supports API, browser extension, Linux, macOS, self-hosted, web and Windows environments. The CLI's Node.js and npm requirement makes it most natural on systems already equipped for JavaScript development. Self-hosting also suits organizations that need control over where scans and SBOM generation run.

Who it's for

Choose Retire.js if you maintain JavaScript or Node.js applications and want a free scanner that can fail scripts on findings, scan a deployed site headlessly, integrate with Burp or ZAP, or emit CycloneDX SBOMs. It is particularly appropriate for technically capable teams comfortable maintaining command-line security tooling.

Look elsewhere if you need a polished browser extension experience, dependable Grunt or Gulp support, or centralized cross-ecosystem administration. The deprecated Firefox extension and unofficial Chrome distribution make browser-led use a poor primary strategy.

Pros and cons

• Pro: Covers both web applications and Node.js projects, including libraries committed into source control.
• Pro: CycloneDX JSON and vulnerability-inclusive SBOM output supports inventory and security workflows.
• Pro: A vulnerability exit code of 13 can stop automated jobs, while --exitwith 0 allows non-blocking scans.
• Pro: Free, self-hosted operation avoids subscription and seat costs.
• Con: The CLI depends on Node.js and npm, which adds setup for teams outside that ecosystem.
• Con: Firefox support is deprecated and Chrome is not officially distributed in the Chrome Web Store.
• Con: Grunt and Gulp integrations are deprecated, reducing its value for older build-tool workflows.

Alternatives

Sonatype Nexus Repository is the better choice when you need a repository platform with full ecosystem support and CI/CD integration; its Community Edition is free, while paid editions add commercial capabilities.

DepWarden suits teams wanting report-only dependency scans without an account or API key; its free plan cannot fail a build, unlike Retire.js's configurable CLI behavior.

Docker Desktop is preferable when dependency checks belong inside a broader Docker development environment rather than a dedicated JavaScript scanner.

Endor Labs fits individual developers seeking local scans through its AURI MCP server with no account required.

ScanCode.io is a free Apache-2.0 option for teams that want containerized or Linux-server software composition analysis.

Snyk Open Source is the stronger alternative when a managed service with project-based plans is preferred.

Socket is worth choosing when extension support and a paid team service with defined scan and API quotas matter.

Accessibility Test Framework for Android is an alternative for Android accessibility testing rather than JavaScript dependency security.

For more choices, browse Software Composition Analysis Software.

Verdict

Retire.js is a strong pick for JavaScript-focused developers who want a free, self-hosted scanner with script-friendly failure behavior, headless checks and CycloneDX SBOM generation. Its main reason to look elsewhere is the aging browser and build-tool support: teams that need maintained extensions, centralized management or broader ecosystem coverage will be better served by a managed SCA platform.