Grype
7.4#3 in software composition analysis softwareFree planFree planLinuxmacOSSelf-hostedWindows
VisitGrype vs Retire.js
Retire.js
6.8#12 in software composition analysis softwareFree planFree planWebAPIExtensionLinux
VisitWhat both publish
| Fact | Grype | Retire.js |
|---|---|---|
| Funding | Anchore announced a $20 million Series A led by SignalFire on January 22, 2020; VentureBeat reported that this brought total funding to about $30 million. | The project says donations fund maintenance of the tool and vulnerability repository. |
| Integrations | The installation documentation provides a Docker image and lists community installation options including Homebrew, MacPorts, Winget, Scoop, and Snapcraft. | Retire.js has a Burp plugin and an OWASP ZAP add-on; ZAP officially supports its add-on and includes it in weekly releases. |
| License | The project is released under the Apache-2.0 License. | The project is published under the Apache-2.0 license. |
| Purpose | Grype scans container images, filesystems, and SBOMs for known vulnerabilities. | Retire.js detects JavaScript library versions with known vulnerabilities, including libraries that are not listed in package manifests. |
Grype plans
- GrypeFree
- Grype open-source scannerFree
Retire.js plans
- Retire.jsFree
Pick Grype if…
Grype suits developers and teams checking packages, images, filesystems, or SBOMs for known vulnerabilities. Its individual-package scanning is also intended for lightweight checks and compliance reviews of specific dependencies.
Pick Retire.js if…
Retire.js suits developers and security teams checking web apps or Node.js projects for vulnerable dependencies. Its CLI, browser extensions, integrations, and SBOM output support different scanning workflows.