loading
Loading content
loading
Static Code Analysis
Detects JavaScript and Node library versions with published vulnerabilities.
overview
Before a release, ask whether the project still ships a JS or Node library version with a published advisory. retire-js fingerprints components under --path and matches each version to known-vulnerable releases.
Widen file types with --ext, skip vendored trees with --ignore or --ignorefile, fail the process at a chosen --severity, and emit text, JSON, or CycloneDX through --outputformat (optional --includeOsv).
Semgrep covers multi-language SAST patterns; trivy spans many ecosystems and containers. retire-js stays JS/Node-focused. Point --path at a project folder; findings write to FILE plus FOLDER for pipeline triage.
use cases
Scan a project's JavaScript files and match each library version against the vulnerability database to flag the ones with published advisories, from bundled front-end scripts to node_modules.
Set --severity so the scan exits non-zero when it finds an issue at or above the level you pick, stopping a pipeline before a risky release ships.
Emit a CycloneDX format through --outputformat to generate a software bill of materials that records every JavaScript component and its known issues, optionally adding OSV advisories with --includeOsv.
Pass an --ignore path list or an --ignorefile to skip vendored or third-party directories so the report focuses on the libraries your project ships.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| path | FOLDER | --path | Folder to scan for JavaScript files. |
| ext | STRING | --ext | Comma-separated list of file extensions for JavaScript files. Default: js. |
| severity | STRING | --severity | Severity level at which the process fails: none, low, medium, high, critical. Default: none. |
| outputformat | STRING | --outputformat | Output format: text, json, jsonsimple, depcheck, and CycloneDX variants. |
| ignore | STRING | --ignore | Comma-delimited list of paths to ignore. |
| deep | BOOLEAN | --deep | Deep scan (slower and experimental). |
| includeOsv | BOOLEAN | --includeOsv | Include OSV advisories in the output. |
| nocache | BOOLEAN | --nocache | Do not use the local cache. |
Showing key inputs. retire-js exposes 15 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| ext | STRING | --ext | Comma separated list of file extensions for JavaScript files. The default is "js". |
| deep | BOOLEAN | --deep | Deep scan (slower and experimental). |
| path | FOLDER | --path | Folder to scan for JavaScript files. |
| proxy | STRING | --proxy | Proxy url (http://some.host:8080). |
| cacert | FILE | --cacert | Use the specified certificate file to verify the peer used for fetching remote jsrepo/noderepo files. |
| colors | BOOLEAN | --colors | Enable color output (console output only). |
| ignore | STRING | --ignore | Comma delimited list of paths to ignore. |
| jsrepo | STRING | --jsrepo | Local or internal version of repo. Can be multiple comma separated. Default: central. |
| nocache | BOOLEAN | --nocache | Don't use local cache. |
| verbose | BOOLEAN | --verbose | Show identified files (by default only vulnerable files are shown). |
| insecure | BOOLEAN | --insecure | Enable fetching remote jsrepo/noderepo files from hosts using an insecure or self-signed SSL (TLS) certificate. |
| severity | STRING | --severity | Specify the bug severity level from which the process fails. Allowed levels none, low, medium, high, critical. Default: none. |
| ignorefile | FILE | --ignorefile | Custom ignore file, defaults to .retireignore / .retireignore.json. |
| includeOsv | BOOLEAN | --includeOsv | Include OSV advisories in the output. |
| outputformat | STRING | --outputformat | Valid formats: text, json, jsonsimple, depcheck (experimental), cyclonedx, cyclonedxJSON, cyclonedxJSON1_6, cyclonedxJSON1_6_VEX. |
example
# scan a web project, widen extensions, fail on high-severity findingsretire --path ./web/src --ext js,mjs --severity high --outputformat json --ignore node_modules,vendor/web/src/vendor/jquery-1.12.4.min.js ↳ jquery 1.12.4 has known vulnerabilities: severity: medium; CVE: CVE-2019-11358; https://github.com/advisories/GHSA-6c3j-c64m-qhgq ↳ jquery 1.12.4 has known vulnerabilities: severity: medium; CVE: CVE-2020-11022, CVE-2020-11023/web/src/vendor/angularjs-1.5.8.min.js ↳ angularjs 1.5.8 has known vulnerabilities: severity: high; CVE: CVE-2020-7676; summary: angular.js XSS via SVG usemap/web/src/vendor/bootstrap-3.3.7.min.js ↳ bootstrap 3.3.7 has known vulnerabilities: severity: medium; CVE: CVE-2018-14041; summary: XSS in data-targetguidance
Use retire-js when the risk is vulnerable JavaScript or Node dependency versions. Prefer semgrep or trivy for multi-language coverage. Prefer secretfinder when the goal is leaked secrets in JS, not CVE versions.
Pattern-based static analysis across many languages, including custom security rules.
Scans dependencies, containers, and IaC for known vulnerabilities across ecosystems.
Finds leaked secrets inside JavaScript files rather than vulnerable library versions.
faq
related
AST-based security checks for Python source.
Detect hardcoded secrets in git repos and plain directories.
Go AST security scanner for credentials, crypto, and injection.
Regex scan of JavaScript for API keys, tokens, JWTs, and similar client-side secrets.
Static analysis with rules that look like the code they match.
Hunt leaked credentials and verify which still work.
A project folder feeds Retire.js, which matches each JavaScript library against the vulnerability database and writes the flagged components as a queryable output.
Facts on this page come from the live Trickest tool library.