RetireJS/retire.js
scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.
License & maintenance
Apache-2.0 is a permissive license: free to use commercially with attribution.
Last code push today.