Is Retire.JS safe?
Retire.JS downloads detector rules from GitHub and evaluates those rule strings in a sandbox while scanning page scripts.
Retire.JS fetches the RetireJS vulnerability repository from GitHub and uses it to detect vulnerable JavaScript libraries on pages you visit. When a page script needs deeper checking, the extension sends the script content into its sandbox and evaluates detector strings from that repository there.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itAnthony Pinto - no other listings under this identity
Anthony Pinto - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 2.2.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Watch every request your browser makes
webRequest
Act on the current tab, but only after you click the extension
activeTab
Run hidden pages in the background
offscreen
See every page you navigate to, as you navigate to it
webNavigation
Where it sends data
Destinations our analysis observed Retire.JS contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- raw.githubusercontent.comwidely used
Retire.JS sends data to raw.githubusercontent.com. A widely used service: 26 other extensions we have analysed send data here.