retire.js by Francesco De Stefano

Is this site running a vulnerable jQuery, lodash, Angular or Handlebars? retire.js tells you as you browse: the toolbar badge shows how many vulnerable JavaScript libraries the page uses, and the panel lists every advisory with its severity, its CVE/GHSA links and the version to upgrade to.

Always up to date — no add-on update needed

• The vulnerability database of the Retire.js project is downloaded from GitHub every day.
• Optional OSV.dev lookups (Google's open vulnerability database) cover every npm package. They are off until you agree, and only the library name and version are sent — never the page address.

Finds libraries everywhere

• File names and URLs, including CDN addresses: jsDelivr, unpkg, cdnjs, esm.sh, code.jquery.com.
• File content and hashes, including big bundles.
• License banners such as /*! axios v0.21.1.
• Inline scripts in the page.
• Global variables: jQuery, Vue, React, Angular, lodash, moment, DOMPurify, axios, Handlebars, Bootstrap and 30 more.

The panel

• Severity summary (critical, high, medium, low), filters and sorting.
• For each library: how it was found, every advisory, and the first version without known issues.
• JSON and CSV export, rescan, and "update database now".
• Dark theme, and a full-width, touch-friendly layout on Firefox for Android.

Privacy: no analytics and no tracking. Details: https://retirejs.sourceforge.io/privacy.html

Documentation and changelog: https://retirejs.sourceforge.io/ — free and open source (Apache 2.0): https://sourceforge.net/projects/retirejs/

Based on the Retire.js project by Erlend Oftedal, Apache 2.0.

Use it responsibly: assessing systems without permission may be illegal. You are responsible for how you use the results.