Phantom Dependency 👻 — Local AI Codebase Auditor for Forgotten & Haunted Packages

Описание и применение

Phantom Dependency — локальный инструмент аудита зависимостей для JavaScript/TypeScript, использующий модель Gemma 3 1B через Ollama. Он классифицирует пакеты как «Resting», «Aging», «Whispering» или «Haunted» на основе статического анализа импортов, lockfile‑версий и баз данных OSV/GHSA, выдавая подробный отчёт без передачи кода внешним сервисам.

Задача

JavaScript/TypeScript projects often contain outdated, unused, or vulnerable dependencies that remain in package manifests, creating technical debt and security risks.

Результат

The tool identifies unused or vulnerable packages, provides evidence-backed classifications, and generates a local forensic report, enabling developers to clean up technical debt without exposing code to external services.

Рабочий процесс

• 1. Run the local CLI or web UI to scan the repository.
• 2. Backend parses .js/.ts/.vue/.svelte files to build an import inventory.
• 3. Lockfile resolver extracts exact versions from npm, pnpm, or yarn files.
• 4. Structured prompt with evidence is sent to local Gemma 3 1B via Ollama.
• 5. AI generates a JSON report classifying each dependency and flags vulnerabilities.
• 6. Frontend visualizes the Graveyard with filters and export options.

Доказательства

Phantom Dependency is an open-source, local-first dependency investigation tool for JavaScript and TypeScript codebases.

Источник

Never label a package abandoned, malicious, or vulnerable without verifiable evidence.

Источник

Powered by Ollama and Google's lightweight gemma3:1b model.

Источник

If Ollama is offline or uninstalled, the tool automatically degrades to deterministic, rule-based templates so developer workflows are never blocked.

Источник