retire.js
Retire.js is a browser tool that detects the use of JavaScript libraries with known vulnerabilities. Helps identify current or insecure dependencies in Web and Node.js applications. It can also produce SBOM (Software Material List) in CycloneDX format for detected libraries.
RetireJS · Build Systems & Monorepos
- Using the command line browser, you detect vulnerable libraries in web or Node.js applications.
- You scan insecure library references on visited sites and receive alerts on the developer console.
- For detected libraries, you create a list of software materials (SBOM) in the CycloneDX format.
- • NeutralHacker News
Retire.js - identify JS libraries with known vulnerabilities in your application
“"As vulnerabilities are discovered in JavaScript libraries, it is vital that we update our dependencies. Retire.js is a command line scanner that helps you identify dependencies with known vulnerabilites in your application. Using the provided Grunt plugin you can easily include…”
- • NeutralGitHub Issue
Add severity
“I think it will be really useful. It might be implemented like this: ``` "vulnerabilities": [{ "below": "1.6.3", "info": [{ "severity": "high", "urls": [" " }] }] ``` What do you think?”