retire.js EN
Francesco De Stefano · Firefox
Finds the JavaScript libraries a site uses and their known vulnerabilities (CVE, GHSA), with a database updated every day. Desktop and Android.
<all_urls>），意味着它可以读取你在任意站点的页面内容，包括已登录的页面。这是许多扩展正常工作的必要条件，但也值得你确认来源可信。
截图
简介
Is this site running a vulnerable jQuery, lodash, Angular or Handlebars? retire.js tells you as you browse: the toolbar badge shows how many vulnerable JavaScript libraries the page uses, and the panel lists every advisory with its severity, its CVE/GHSA links and the version to upgrade to.
Always up to date — no add-on update needed
- The vulnerability database of the Retire.js project is downloaded from GitHub every day.
- Optional OSV.dev lookups (Google's open vulnerability database) cover every npm package. They are off until you agree, and only the library name and version are sent — never the page address.
Finds libraries everywhere
- File names and URLs, including CDN addresses: jsDelivr, unpkg, cdnjs, esm.sh, code.jquery.com.
- File content and hashes, including big bundles.
- License banners such as
/*! axios v0.21.1. - Inline scripts in the page.
- Global variables: jQuery, Vue, React, Angular, lodash, moment, DOMPurify, axios, Handlebars, Bootstrap and 30 more.
The panel
- Severity summary (critical, high, medium, low), filters and sorting.
- For each library: how it was found, every advisory, and the first version without known issues.
- JSON and CSV export, rescan, and "update database now".
- Dark theme, and a full-width, touch-friendly layout on Firefox for Android.
Privacy: no analytics and no tracking. Details: https://retirejs.sourceforge.io/privacy.html
Documentation and changelog: https://retirejs.sourceforge.io/ — free and open source (Apache 2.0): https://sourceforge.net/projects/retirejs/
Based on the Retire.js project by Erlend Oftedal, Apache 2.0.
Use it responsibly: assessing systems without permission may be illegal. You are responsible for how you use the results.
retire.js 是做什么的
retire.js 是一款面向 Firefox 的开发者工具类扩展，主要用来调试页面、查看样式与请求、测试接口、辅助前端开发。官方对它的介绍是：Finds the JavaScript libraries a site uses and their known vulnerabilities (CVE, GHSA), with a database updated every day. Desktop and Android.在Firefox 附加组件商店（AMO）上，它当前版本 3.1.1，评分 4.75（12 人评价），约 4,977 名用户。
适合什么人用
从功能定位看，retire.js 更适合前端工程师、测试与需要经常查看页面结构的用户。如果你平时只是偶尔遇到相关需求，用浏览器自带功能也能凑合；但如果这件事每天都发生，装一个专门处理它的扩展通常比手动操作省事得多。需要注意的是它作用于所有网站，装上后建议先观察一两天，确认不影响常用站点的正常使用。
怎么安装 retire.js
- 打开Firefox 附加组件商店（AMO）上的官方页面；
- 点「添加到浏览器」并确认权限提示；
- 装好后在扩展列表里固定图标，方便随时开关。
本站只做索引与介绍，安装包来自官方商店。如果商店页面提示当前地区不可用，说明该扩展未在你所在区域上架。
常见问题
retire.js 是免费的吗？
retire.js 在Firefox 附加组件商店（AMO）免费提供下载。它是浏览器扩展，装上就能直接用，不需要注册账号。
retire.js 安全吗？
它只申请了 0 项权限，范围比较克制，没有申请「读取所有网站数据」这种大权限。
retire.js 支持哪些浏览器？
当前收录的版本来自Firefox 附加组件商店（AMO），适用于 Firefox。同一个扩展在其他商店可能有对应版本，但功能与版本号不一定相同。
怎么卸载 retire.js？
在扩展管理页找到 retire.js，点移除即可。它在本地保存的设置会一起清掉，不会残留数据。
权限清单 来自 manifest.json 原文
站点访问 1
<all_urls>
接口权限 3
alarmsstoragewebRequest