retire.js for Firefoxretire.js for Firefox
Find the JavaScript libraries a site uses and their known vulnerabilities, as you browse.
Always up to date — no add-on update needed
Earlier versions shipped a fixed list of vulnerabilities, which aged between releases. Version 3 keeps the data fresh by itself:
- Retire.js database. It is downloaded from the Retire.js project on GitHub every day. That project updates it automatically from the GitHub Advisory Database. A copy ships inside the add-on for the first start and for offline use.
- OSV.dev, optional and off until you agree. OSV.dev is Google's open vulnerability database and covers every npm package. Only the library name and version are sent (see Privacy).
How libraries are found
| Source | Example |
|---|---|
| File name and URL | jquery-1.8.1.min.js |
| CDN addresses | cdn.jsdelivr.net/npm/lodash@4.17.15/…, unpkg.com/react@16.8.0/…, cdnjs…/ajax/libs/moment.js/2.19.1/…, code.jquery.com/jquery-3.4.1.js |
| File content and SHA-1 hashes | bundles that contain jQuery, Handlebars, DOMPurify… |
| License banners | /*! axios v0.21.1 … |
Inline <script> blocks | the same rules, applied to scripts written in the page |
| Global variables | jQuery.fn.jquery, Vue.version, React.version, [ng-version], lodash, moment, DOMPurify, axios, Handlebars, Bootstrap and 30 more |
The panel
- Severity summary (critical, high, medium, low and libraries with no known issues).
- For each library: its version, how it was found, every advisory with its CVE and GitHub links, the version that fixes it, and the first version without known issues. This is checked against the whole database, so you are not sent to a version that is itself vulnerable.
- Filter by Vulnerable or All libraries, and sort by severity, name or number of issues.
- JSON and CSV export, rescan, and "update database now".
- The toolbar badge shows how many vulnerable libraries the page has, in the colour of the worst severity.
Firefox for Android
On Android the panel uses the full screen width, with touch-sized controls. Open it from ⋮ → Extensions → retire.js.
Permissions
| Permission | Why |
|---|---|
| Access your data for all websites | Read the scripts the page loads and run the small page probe. |
| webRequest (non-blocking) | Notice which scripts a page loads and reset the results when the page changes. Nothing is modified. |
| storage, alarms | Settings, the downloaded database and the daily update. |
| Optional: website content | Only if you turn on OSV.dev: library names and versions are sent to api.osv.dev. |
Use it responsibly
retire.js only reads what your browser has already downloaded. Assessing systems you do not own, or have no permission to test, may be illegal. You are responsible for how you use the results.
Source code and credits
The source is plain JavaScript with tests that drive a real Firefox. Get it with git clone https://git.code.sf.net/p/retirejs/code retirejs, or download it from Files.
The detection core and the vulnerability database come from the Retire.js project by Erlend Oftedal, under the Apache License 2.0.