Scan a project for vulnerable JavaScript and Node libraries

retire-js answers one question across a codebase: are you shipping a JavaScript or Node library version with a published vulnerability? Using components with known vulnerabilities is its own entry on the OWASP Top 10, and one stale bundled library can expose an entire web app. retire-js fingerprints the libraries it finds, matches each version against a database of known-vulnerable releases, and reports the advisories behind every match.

Point --path at a folder and it walks the tree by file extension, so you can target plain .js or widen the set with --ext, while --ignore skips vendored paths you do not control. Output comes in text, JSON, jsonsimple, and several CycloneDX SBOM variants through --outputformat, which lets you feed results into a dashboard, a build gate, or a bill of materials. Set --severity and the process exits non-zero once a finding crosses the level you choose.

On Trickest, retire-js runs as a Static Code Analysis node that takes a project folder and writes the flagged components as a file and a folder. Wire it into a build or audit pipeline so dependency risk surfaces before a release ships.