Phantom Dependency 👻 — Local AI Codebase Auditor for Forgotten & Haunted Packages

说明与用途

Phantom Dependency 是一个本地 AI 依赖审计工具，使用 Gemma 3 1B 通过 Ollama 对 JavaScript/TypeScript 项目进行扫描，基于静态导入、lockfile 版本和 OSV/GHSA 安全通报将依赖分类为 Resting、Aging、Whispering 或 Haunted，并生成本地审计报告，完全不向外部服务泄露代码。

问题

JavaScript/TypeScript projects often contain outdated, unused, or vulnerable dependencies that remain in package manifests, creating technical debt and security risks.

结果

The tool identifies unused or vulnerable packages, provides evidence-backed classifications, and generates a local forensic report, enabling developers to clean up technical debt without exposing code to external services.

工作流

• 1. Run the local CLI or web UI to scan the repository.
• 2. Backend parses .js/.ts/.vue/.svelte files to build an import inventory.
• 3. Lockfile resolver extracts exact versions from npm, pnpm, or yarn files.
• 4. Structured prompt with evidence is sent to local Gemma 3 1B via Ollama.
• 5. AI generates a JSON report classifying each dependency and flags vulnerabilities.
• 6. Frontend visualizes the Graveyard with filters and export options.

证据

Phantom Dependency is an open-source, local-first dependency investigation tool for JavaScript and TypeScript codebases.

来源

Never label a package abandoned, malicious, or vulnerable without verifiable evidence.

来源

Powered by Ollama and Google's lightweight gemma3:1b model.

来源

If Ollama is offline or uninstalled, the tool automatically degrades to deterministic, rule-based templates so developer workflows are never blocked.

来源