# retire.js: detecting vulnerable JavaScript dependencies

> How to install and run retire.js, and how to turn a vulnerable-library match into a finding a client can act on.

`retire.js` identifies JavaScript libraries with known vulnerabilities. It fingerprints library versions from file contents and URLs, then matches them against a vulnerability database. It is one of the few checks that works equally well from outside — you do not need the source repository, only the bundle the site serves.

## Install

```bash
npm install -g retire
```

## Core commands

```bash
# a project directory
retire --path ./frontend

# only JavaScript, ignore node_modules
retire --path ./frontend --js --ignore node_modules

# JSON for import
retire --path ./frontend --outputformat json --outputpath retire.json

# severity threshold
retire --path ./frontend --severity high
```

For remote scanning, download the bundles first and scan the directory — the browser extension covers ad-hoc checks but does not script well.

## Output

```json
{"file":"static/jquery-1.8.3.min.js","results":[{"component":"jquery","version":"1.8.3",
 "vulnerabilities":[{"severity":"medium","identifiers":{"CVE":["CVE-2015-9251"]},
 "info":["https://github.com/jquery/jquery/issues/2432"]}]}]}
```

## Where it sits in Tandera

retire.js runs in the **analyze** phase of `recon_web_lite` and `recon_web_full`, against the JavaScript assets recovered during crawling. Because it needs no active payloads, it is allowed in the `NonIntrusive` lite flow.

Its CVE identifiers map onto the finding catalogue, so a vulnerable library becomes a finding with a CVE, a CVSS score and EPSS context rather than a raw version string.

## Using it in a pentest

**Version-based findings need exploitability context or they are noise.** "jQuery 1.8.3 has CVE-2015-9251" is true and nearly useless on its own. The client needs to know whether the vulnerable code path is reachable in this application. Check it before you assign a severity.

**Check the CDN, not just the bundle.** Applications frequently load a modern framework locally and an ancient utility library from a CDN. The CDN copy is the one nobody tracks.

**Prefer the version over the CVE in the remediation.** "Upgrade jQuery to 3.5.0 or later" is actionable. A list of CVE identifiers is a research task you are handing back to the client.

---

Canonical: https://tandera.io/tools/retirejs
This page as markdown: https://tandera.io/tools/retirejs.md
Index for agents: https://tandera.io/llms.txt

Every page here is also available as markdown: append `.md` to the path (e.g. `/recon.md`, `/index.md` for this homepage, `/blog/<slug>.md`), or request the canonical path with `Accept: text/markdown`.