Retire.js

At a glance

• Editor score
  5.3 / 10
• Pricing
  Free plan
• Best for
  JavaScript teams scanning web applications
• Free plan
  Yes
• Paid from
  Free
• SBOM generation
  Yes
• Facts checked
  19 Sep 2026

• Where it wins

  • Scans JavaScript libraries in source files and Node.js modules
  • Generates CycloneDX SBOMs in XML and JSON formats
  • Integrates with Burp Suite and OWASP ZAP

• Where it doesn't

  • Focuses on JavaScript and Node.js rather than broader ecosystems
  • Firefox support is deprecated
  • The Chrome extension is not officially available in the Chrome Web Store

Our verdict on Retire.js

Retire.js is an open-source software composition analysis tool for developers working with web applications and Node.js applications. Its command-line scanner detects JavaScript libraries with known vulnerabilities, including libraries stored directly in source control rather than declared in package manifests. It also scans Node.js modules, making it a focused option for teams whose dependency risk is concentrated in these ecosystems.

The project covers several stages of web application review without adding a paid tier: a headless website scanner, a Chrome browser extension for identifying insecure libraries on visited sites, and integrations with Burp Suite and OWASP ZAP. CycloneDX software bills of materials can be generated in XML and JSON formats. Retire.js is self-hosted and distributed under the Apache License 2.0, so it suits teams comfortable incorporating an open-source scanning tool into their own development or security workflows. The published project details identify no paid plans.

That narrow ecosystem is also the main boundary. Retire.js targets JavaScript, Node.js modules, and npm rather than broad multi-language composition analysis, so organizations needing wider ecosystem coverage should look elsewhere. Browser availability also calls for care: Firefox support is deprecated, and the Chrome extension is not officially available in the Chrome Web Store. Teams primarily seeking a JavaScript-focused scanner with SBOM generation and Burp Suite or ZAP integration may find the scope appropriate; teams requiring broader ecosystem support or dependable browser-extension distribution should consider an alternative.

Your product? Our editors can test Retire.js in depth and publish a review, labelled as paid · from $149/mo →

Retire.js pricing

Retire.js fact sheet

Retire.js integrations

Retire.js lists 2 integrations on its own site.

• Burp Suite
• OWASP ZAP

Alternatives to Retire.js

• Snyk Open SourceBroad SCA coverage with reachability, SBOMs, pull-request scanning, and monitoring.9.4
• FOSSAA mature SCA platform covering dependencies, SBOMs, containers, licenses, and policy controls.9.3
• Safeguard SCAA budget-conscious SCA platform with reachability analysis, SBOMs, and remediation workflows.9.1

See all Retire.js alternatives →

Featured on iTechGuides

Retire.js is listed in our Software Composition Analysis Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/retire-js/"><img src="https://www.itechguides.com/best/badge/retire-js.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 7 Oct 2026 · How we research and update