retire.js

retire.js shows which JavaScript libraries the page you are visiting uses, and warns you when one of them has known security vulnerabilities.

ALWAYS UP TO DATE
- The Retire.js vulnerability database is downloaded from GitHub every day: new vulnerabilities arrive without an extension update. A copy ships inside the extension for the first start and offline use.
- Optional OSV.dev lookups (Google's open vulnerability database) cover every npm package. Off until you agree; only the library name and version are sent.

HOW LIBRARIES ARE FOUND
- File names and URLs (jquery-1.8.1.min.js)
- CDN addresses: jsDelivr, unpkg, cdnjs, esm.sh, code.jquery.com
- File content and SHA-1 hashes
- License banners (/*! axios v0.21.1 ...)
- Inline <script> blocks
- Global variables: jQuery, Vue, React, Angular, lodash, moment, DOMPurify, axios, Handlebars, Bootstrap and 30 more

THE PANEL
- Severity summary: critical, high, medium, low
- For each library: version, how it was found, every advisory with CVE and GitHub links, the version that fixes it and the first version with no known issues
- Filter and sort, JSON and CSV export, rescan, update database now
- Light and dark theme
- The toolbar badge shows how many vulnerable libraries the page has, in the colour of the worst severity

PRIVACY
No analytics, no tracking. Nothing leaves your browser except the daily database download and, only if you turn it on, the OSV.dev lookups (library name and version only).

Source code and support: https://retirejs.sourceforge.io/