RetireJS

retire --path <path>

Scans JavaScript code with Retire.js, detecting libraries with known vulnerabilities (including legacy versions).

Run it in the JS project pipeline (or in a point-in-time scan) when you want detection of vulnerable libraries: retire analyzes JS files (included libraries, even those not managed by the package manager — manually downloaded, from CDN) and reports versions with known vulnerabilities from the Retire.js repository. It's the SCA for legacy JS libraries: those that npm audit doesn't see (those not in the manager's tree). In DevSecOps, Retire.js complements Node's SCA: project's loose libraries detected with their CVEs.

Don't use it as a full SCA: retire covers JS libraries from the repository — manager dependencies (npm tree) are covered by npm audit (020); retire is for libraries not managed by the package manager. The Retire.js repository is updated: new CVEs require updating. And watch out: findings are triaged (false positives from versions). For commercial SCA, use Snyk (019); retire is the check for legacy libraries.