Phantom Dependency 👻 — Local AI Codebase Auditor for Forgotten & Haunted Packages
This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine What I Built "Every project has a past. Discover the dependencies haunting yours." In modern software development, every codebase inherits ghosts. We install packages for a sprint hack, abandon utility
Hacktoberfest Open-Source AI Challenge: Ghost in the Machine Submission 👻🌼
This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine
"Every project has a past. Discover the dependencies haunting yours."
Unlike conventional dependency scanners that trigger alarm fatigue by screaming about every package older than a year, Phantom Dependency adheres to a strict standard: Never label a package abandoned, malicious, or vulnerable without verifiable evidence. Every classification is backed by concrete lockfile versions, static AST import walks, and verified OSV/GHSA security advisory databases.
Watch the complete step-by-step walkthrough of Phantom Dependency in action, analyzing a haunted testbed codebase, classifying packages, and generating local AI forensic reports:
The entire codebase is open source under the MIT License and organized as a clean monorepo:
Beneath its spooky haunted codebase aesthetic lies a serious developer security and audit tool: