New Research: Supply Chain Attack on Axios Pulls Malicious Dependency from npm.Details →
Socket
Book a DemoSign in
Socket

ghost-deps

Package Overview
Dependencies
Maintainers
1
Versions
5
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

ghost-deps

Detect ghost/phantom dependencies in Node.js projects by analyzing imports vs package.json.

latest
Source
npmnpm
Version
0.1.5
Version published
Maintainers
1
Created
Source

🕵️‍♂️ ghost-deps

Find and track ghost dependencies hiding in your Node.js projects. Ever had a package installed that you don’t actually use — or an import that isn’t listed in your package.json? ghost-deps helps you clean that up.

🚀 What It Does

ghost-deps scans your project files and compares all imports/require calls with your package.json dependencies.

It then reports:

  • 📦 Unused dependencies – listed in package.json but never imported
  • 👻 Ghost dependencies – imported in your code but missing from package.json
  • 🧹 Summary report – quick overview of what to remove or install

📦 Installation

You can install it globally or locally:

npm install -g ghost-deps

or in a project:

npm install --save-dev ghost-deps

Then you can run:

ghost-deps --path .

🧭 Usage

ghost-deps [options]

Options:

FlagDescriptionDefault
--pathPath to your project root.
--ignoreComma-separated list of globs to ignorenode_modules/**
--jsonOutput report as JSONfalse
-o, --output <file>Save the output to a filestdout

Example:

ghost-deps --path ./my-app

Output:

🔍 Scanning ./my-app

Unused dependencies:
- chalk
- lodash

Ghost dependencies:
- express (imported in src/server.ts)

🧠 Why Use It?

  • Keep your package.json tidy
  • Reduce unnecessary install size
  • Avoid runtime errors from missing deps
  • Great for large repos and CI checks

🛠️ Development

Clone the repo and build from source:

git clone https://github.com/yourusername/ghost-deps.git
cd ghost-deps
npm install
npm run build

Run locally:

node bin/ghost-deps.js --path .

🧩 Tech Stack

  • TypeScript
  • tsup
  • Babel Parser
  • globby

📄 License

MIT © majcek210

Keywords

dependencies

FAQs

Package last updated on 11 Oct 2025

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts