Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

Retire.js review

Free#57 of 65 in Software Composition Analysis Software

A focused, free scanner for JavaScript and Node.js vulnerabilities, with CycloneDX SBOM output.

5.3/10Editor score
Visit Retire.js
Retire.js5.3 Visit Retire.js

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Retire.js is an open-source software composition analysis tool for developers working with web applications and Node.js applications. Its command-line scanner detects JavaScript libraries with known vulnerabilities, including libraries stored directly in source control rather than declared in package manifests. It also scans Node.js modules, making it a focused option for teams whose dependency risk is concentrated in these ecosystems.

The project covers several stages of web application review without adding a paid tier: a headless website scanner, a Chrome browser extension for identifying insecure libraries on visited sites, and integrations with Burp Suite and OWASP ZAP. CycloneDX software bills of materials can be generated in XML and JSON formats. Retire.js is self-hosted and distributed under the Apache License 2.0, so it suits teams comfortable incorporating an open-source scanning tool into their own development or security workflows. The published project details identify no paid plans.

That narrow ecosystem is also the main boundary. Retire.js targets JavaScript, Node.js modules, and npm rather than broad multi-language composition analysis, so organizations needing wider ecosystem coverage should look elsewhere. Browser availability also calls for care: Firefox support is deprecated, and the Chrome extension is not officially available in the Chrome Web Store. Teams primarily seeking a JavaScript-focused scanner with SBOM generation and Burp Suite or ZAP integration may find the scope appropriate; teams requiring broader ecosystem support or dependable browser-extension distribution should consider an alternative.

Retire.js pros and cons

  • Where it wins
    • Scans JavaScript libraries in source files and Node.js modules
    • Generates CycloneDX SBOMs in XML and JSON formats
    • Integrates with Burp Suite and OWASP ZAP
  • Where it doesn't
    • Focuses on JavaScript and Node.js rather than broader ecosystems
    • Firefox support is deprecated
    • The Chrome extension is not officially available in the Chrome Web Store

Retire.js fact sheet, pricing and score →

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update