Free JavaScript static analyzers on SecBench.js injection bugs: 8 tools ranked
On the sealed test half of SecBench.js (64 command and code injection bugs in npm libraries), Penthera 2.0.0 ranked 1st of 8 free tools, with share found in the right file 0.70. odgen scored 0.68, within the margin of error, so read it as a tie. Measured on 25 October 2026.
Which free static analyzer finds the most injection bugs in JavaScript libraries?
Penthera 2.0.0 ranked 1st of 8 free tools by share found in the right file (0.70), within the margin of error of odgen (0.68). Scored by share of command and code injection bugs found in the right file.
- Penthera0.70
- odgen0.68
- codeql0.64
- eslint-plugin-security0.64
- semgrep0.38
- graudit0.34
- bearer0.22
- njsscan0.05
Every tool, with 95% intervals
Counts are found over total. Intervals are 95% Wilson intervals. Penthera's row is bold.
| Rank | Tool | Command injection | Code injection | Score: share found in the right file |
|---|---|---|---|---|
| 1 | Penthera 2.0.0 | 35/47 | 10/17 | 0.70 [0.58, 0.80] 45/64 |
| 2 | odgen c5157ee | 36/46 | 6/16 | 0.68 [0.55, 0.78] 42/62 |
| 3 | codeql 2.27.2 | 37/47 | 4/17 | 0.64 [0.52, 0.75] 41/64 |
| 4 | eslint-plugin-security 4.2.0 | 32/47 | 9/17 | 0.64 [0.52, 0.75] 41/64 |
| 5 | semgrep 1.180.0 | 15/47 | 9/17 | 0.38 [0.27, 0.50] 24/64 |
| 6 | graudit 849d7c7 | 12/47 | 10/17 | 0.34 [0.24, 0.47] 22/64 |
| 7 | bearer 2.1.1 | 14/47 | 0/17 | 0.22 [0.14, 0.33] 14/64 |
| 8 | njsscan 1.0.1 | 2/45 | 1/15 | 0.05 [0.02, 0.14] 3/60 |
| Not ranked | Penthera 1.9.0 | 0/47 | 10/17 | 0.16 [0.09, 0.26] 10/64 |
| Not ranked | semgrep, every file 1.180.0 | 16/47 | 9/17 | 0.39 [0.28, 0.51] 25/64 |
- codeql and eslint-plugin-security have the same score, 0.64; the order between them carries no meaning.
- codeql: used under the GitHub CodeQL terms, for research on open-source code.
- A rank needs at least five other free tools measured; this benchmark has 7.
- Median score of the other free tools: 0.38.
Not ranked, and why
- Penthera 1.9.0: the previous release, for comparison. Score 0.16.
- semgrep, every file 1.180.0: another setting of semgrep, not ranked. Score 0.39.
Where another tool does better than Penthera
- Command injection: codeql 0.79, Penthera 0.74. Overall, codeql scored 0.64.
Tools that are not here
Paid tools (GitGuardian, Socket, Snyk, Phylum, Semgrep Pro) are not here. None publishes results on these benchmarks; we cannot measure them (cost and licence terms).
Published elsewhere, on other data
Not comparable with the numbers above: other datasets, other scoring.
Check it yourself
The dataset is SecBench.js. The ranking rules were written down before the run: the protocol. Every number on this page is read from published.json when the site is built; the results file has the method and per-family detail, and the runner's README says how to reproduce it.
Measured on . Sealed test half, scored once (E11b § 10). All four benchmarks.
penthera.org · Benchmarks · Blog · Live check · Terms · Trust · Source · MIT license