# Free JavaScript static analyzers on SecBench.js injection bugs: 8 tools ranked

> Which free static analyzer finds the most injection bugs in JavaScript libraries?

On the sealed test half of SecBench.js (64 command and code injection bugs in npm libraries), Penthera 2.0.0 ranked 1st of 8 free tools, with share found in the right file 0.70. odgen scored 0.68, within the margin of error, so read it as a tie. Measured on 25 October 2026.

## Read this before the numbers

- A bug counts only when the tool points at the right file. False alarms are not part of this score.
- A few packages appeared on both halves of the split; the results file reports the score without them.
- Penthera's code-injection count did not move between releases. The gain is in command injection.
- The free tools ran on their defaults. Penthera was tuned on the other half of the dataset, then scored once on this half.
- A benchmark is not your code. Accuracy on real projects is experiment E1, pre-registered and not yet run.

## Every tool, with 95% intervals

Scored by share of command and code injection bugs found in the right file. Counts are found over total; intervals are 95% Wilson.

| Rank | Tool | Command injection | Code injection | share found in the right file |
|---|---|---|---|---|
| 1 | **Penthera 2.0.0** | 35/47 | 10/17 | 0.70 [0.58, 0.80] |
| 2 | odgen c5157ee | 36/46 | 6/16 | 0.68 [0.55, 0.78] |
| 3 | codeql 2.27.2 | 37/47 | 4/17 | 0.64 [0.52, 0.75] |
| 4 | eslint-plugin-security 4.2.0 | 32/47 | 9/17 | 0.64 [0.52, 0.75] |
| 5 | semgrep 1.180.0 | 15/47 | 9/17 | 0.38 [0.27, 0.50] |
| 6 | graudit 849d7c7 | 12/47 | 10/17 | 0.34 [0.24, 0.47] |
| 7 | bearer 2.1.1 | 14/47 | 0/17 | 0.22 [0.14, 0.33] |
| 8 | njsscan 1.0.1 | 2/45 | 1/15 | 0.05 [0.02, 0.14] |
| – | Penthera 1.9.0 | 0/47 | 10/17 | 0.16 [0.09, 0.26] |
| – | semgrep, every file 1.180.0 | 16/47 | 9/17 | 0.39 [0.28, 0.51] |

Not ranked: Penthera 1.9.0 (the previous release, for comparison); semgrep, every file 1.180.0 (another setting of semgrep, not ranked).

## Where another tool does better than Penthera

- Command injection: codeql 0.79, Penthera 0.74. Overall, codeql scored 0.64.

## Sources

- Dataset: [SecBench.js](https://github.com/cristianstaicu/SecBench.js)
- Numbers: https://github.com/danoszz/penthera/blob/main/bench/public/published.json (measured 2026-10-25; Sealed test half, scored once (E11b § 10).)
- Protocol: https://github.com/danoszz/penthera/blob/main/docs/research/prereg/E11b-improvement-study.md
- All four benchmarks: https://penthera.org/benchmarks.md