Static Code Analysis
Flag known-vulnerable JavaScript and Node library versions
Detects JavaScript and Node library versions with published vulnerabilities.
overview
What retire-js does
Before a release, ask whether the project still ships a JS or Node library version with a published advisory. retire-js fingerprints components under --path and matches each version to known-vulnerable releases.
Widen file types with --ext, skip vendored trees with --ignore or --ignorefile, fail the process at a chosen --severity, and emit text, JSON, or CycloneDX through --outputformat (optional --includeOsv).
Semgrep covers multi-language SAST patterns; trivy spans many ecosystems and containers. retire-js stays JS/Node-focused. Point --path at a project folder; findings write to FILE plus FOLDER for pipeline triage.
use cases
Where retire-js fits
Detect known-vulnerable JavaScript and Node libraries
Scan a project's JavaScript files and match each library version against the vulnerability database to flag the ones with published advisories, from bundled front-end scripts to node_modules.
Gate a build on severity
Set --severity so the scan exits non-zero when it finds an issue at or above the level you pick, stopping a pipeline before a risky release ships.
Produce an SBOM for JavaScript dependencies
Emit a CycloneDX format through --outputformat to generate a software bill of materials that records every JavaScript component and its known issues, optionally adding OSV advisories with --includeOsv.
Scope the scan to code you own
Pass an --ignore path list or an --ignorefile to skip vendored or third-party directories so the report focuses on the libraries your project ships.
reference
retire-js inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| path | FOLDER | --path | Folder to scan for JavaScript files. |
| ext | STRING | --ext | Comma-separated list of file extensions for JavaScript files. Default: js. |
| severity | STRING | --severity | Severity level at which the process fails: none, low, medium, high, critical. Default: none. |
| outputformat | STRING | --outputformat | Output format: text, json, jsonsimple, depcheck, and CycloneDX variants. |
| ignore | STRING | --ignore | Comma-delimited list of paths to ignore. |
| deep | BOOLEAN | --deep | Deep scan (slower and experimental). |
| includeOsv | BOOLEAN | --includeOsv | Include OSV advisories in the output. |
| nocache | BOOLEAN | --nocache | Do not use the local cache. |
Showing key inputs. retire-js exposes 15 inputs in total.
Full flag reference (15 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| ext | STRING | --ext | Comma separated list of file extensions for JavaScript files. The default is "js". |
| deep | BOOLEAN | --deep | Deep scan (slower and experimental). |
| path | FOLDER | --path | Folder to scan for JavaScript files. |
| proxy | STRING | --proxy | Proxy url (http://some.host:8080). |
| cacert | FILE | --cacert | Use the specified certificate file to verify the peer used for fetching remote jsrepo/noderepo files. |
| colors | BOOLEAN | --colors | Enable color output (console output only). |
| ignore | STRING | --ignore | Comma delimited list of paths to ignore. |
| jsrepo | STRING | --jsrepo | Local or internal version of repo. Can be multiple comma separated. Default: central. |
| nocache | BOOLEAN | --nocache | Don't use local cache. |
| verbose | BOOLEAN | --verbose | Show identified files (by default only vulnerable files are shown). |
| insecure | BOOLEAN | --insecure | Enable fetching remote jsrepo/noderepo files from hosts using an insecure or self-signed SSL (TLS) certificate. |
| severity | STRING | --severity | Specify the bug severity level from which the process fails. Allowed levels none, low, medium, high, critical. Default: none. |
| ignorefile | FILE | --ignorefile | Custom ignore file, defaults to .retireignore / .retireignore.json. |
| includeOsv | BOOLEAN | --includeOsv | Include OSV advisories in the output. |
| outputformat | STRING | --outputformat | Valid formats: text, json, jsonsimple, depcheck (experimental), cyclonedx, cyclonedxJSON, cyclonedxJSON1_6, cyclonedxJSON1_6_VEX. |
example
Run retire-js
# scan a web project, widen extensions, fail on high-severity findingsretire --path ./web/src --ext js,mjs --severity high --outputformat json --ignore node_modules,vendor/web/src/vendor/jquery-1.12.4.min.js ↳ jquery 1.12.4 has known vulnerabilities: severity: medium; CVE: CVE-2019-11358; https://github.com/advisories/GHSA-6c3j-c64m-qhgq ↳ jquery 1.12.4 has known vulnerabilities: severity: medium; CVE: CVE-2020-11022, CVE-2020-11023/web/src/vendor/angularjs-1.5.8.min.js ↳ angularjs 1.5.8 has known vulnerabilities: severity: high; CVE: CVE-2020-7676; summary: angular.js XSS via SVG usemap/web/src/vendor/bootstrap-3.3.7.min.js ↳ bootstrap 3.3.7 has known vulnerabilities: severity: medium; CVE: CVE-2018-14041; summary: XSS in data-targetguidance
Choosing retire-js
Use retire-js when the risk is vulnerable JavaScript or Node dependency versions. Prefer semgrep or trivy for multi-language coverage. Prefer secretfinder when the goal is leaked secrets in JS, not CVE versions.
semgrep
Pattern-based static analysis across many languages, including custom security rules.
trivy
Scans dependencies, containers, and IaC for known vulnerabilities across ecosystems.
secretfinder
Finds leaked secrets inside JavaScript files rather than vulnerable library versions.
faq
retire-js questions
related
More Static Code Analysis tools
bandit
AST-based security checks for Python source.
gitleaks
Detect hardcoded secrets in git repos and plain directories.
gosec
Go AST security scanner for credentials, crypto, and injection.
secretfinder
Regex scan of JavaScript for API keys, tokens, JWTs, and similar client-side secrets.
semgrep-scan
Static analysis with rules that look like the code they match.
trufflehog
Hunt leaked credentials and verify which still work.
Run retire-js yourself
A project folder feeds Retire.js, which matches each JavaScript library against the vulnerability database and writes the flagged components as a queryable output.
Facts on this page come from the live Trickest tool library.