{"repo":"RetireJS/retire.js","free":true,"listed":false,"github":"https://github.com/RetireJS/retire.js","clone":"git clone https://github.com/RetireJS/retire.js.git","description":"scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.","language":"JavaScript","stars":4159,"topics":["vulnerabilities","scanner","firefox-extension","grunt-plugins","javascript","vulnerable-libraries","insecure-libraries","chrome-extension","build-tool","security"],"license":"Apache-2.0","category":"security-tools","readme_excerpt":"Retire.js What you require you must also retire There is a vast ecosystem of JavaScript libraries available for both web and Node.js applications. While these libraries significantly accelerate development, they also require ongoing maintenance to ensure security vulnerabilities are addressed promptly. In 2013, “Using Components with Known Vulnerabilities” was added to the OWASP Top 10 list of critical security risks, highlighting the serious threat that outdated or insecure dependencies can pose to web applications. Retire.js was created to help developers identify JavaScript library versions with known vulnerabilities, especially those that are not in package manifests, but simply downloaded and put in source control. Retire.js can be used in many ways: 1. As command line scanner 2. As a Chrome extension - Not officially available in the Chrome web store 3. As a Burp Extension or OWASP ZAP Add-on 4. As a Firefox extension - Deprecated Let us know if you want to maintain and undeprecate it. 5. A headless web site scanner 6. As a grunt plugin (deprecated) 7. As a gulp task (deprecated) Command line scanner Scan a web app or node app for use of vulnerable JavaScript libraries and/or Node.JS modules. If you haven't already, you need to install node/npm first. In the source code folder of the application folder run: SBOM generation retire.js can generate SBOMs in the CycloneDX-format: By default retire.js will exit with code 13 if it finds vulnerabilities. This can be overridde","default_branch":null,"files":null,"tree":[],"storefront":"/r/RetireJS","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/RetireJS/retire.js/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}