{"slug": "exorcist-a-ghost-hunter-for-your-package-json", "title": "Exorcist: a ghost hunter for your package.json", "summary": "A developer built Exorcist, an open-source dependency health scanner for package.json that runs entirely in the browser and flags issues npm audit misses, including deprecated packages, functional duplicates, major-version lag, oversized bundles, copyleft licenses in permissive projects, and dependencies with no publish in two years. The tool uses Google's EmbeddingGemma 300M embedding model via Transformers.js on ONNX Runtime WebAssembly to detect functionally equivalent packages by cosine similarity above an 82% threshold, and rolls findings into a 0–100 health score. It is MIT licensed and available on GitHub.", "body_md": "*This is a submission for the [Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine](https://dev.to/challenges/hacktoberfest-week4-2026-10-26)*\n\n**Exorcist** is a dependency health scanner for `package.json` — the checks\n\n`npm audit` doesn't run. Drop in a file (or paste a GitHub repo URL) and it\n\nfinds the slow rot every Node project accumulates: deprecated packages,\n\nfunctional duplicates nobody noticed they installed twice, packages a major\n\nversion or more behind, oversized bundles, copyleft licenses hiding in a\n\npermissive project, and dependencies with no publish in two years. It rolls\n\neverything into a single 0–100 health score and tells you what to do about\n\neach finding.\n\nFor the theme — *Ghost in the Machine* — I leaned all the way in: a Victorian\n\nbroadside-poster UI, a blood-drip ceiling, flickering candles, a lantern that\n\nfollows your cursor, and a results screen presented as a morgue toe-tag.\n\nFindings are \"spirits\" (Dead, Dormant, Cursed, Ancient, Bloated, Possessed,\n\nand Resurrection for the alternatives it suggests). It's a bit much. That was\n\nthe point.\n\n**Live:** [https://exorcist-hf26-wk4.onrender.com](https://exorcist-hf26-wk4.onrender.com)\n\nClick **\"Try a demo tome\"** on the landing page to scan a deliberately haunted\n\n`package.json` — it has lodash+underscore duplicates, deprecated `left-pad`\n\nand `request`, and a few other dependency sins, so you can see every check\n\nfire without hunting down a real cursed project first.\n\nNo login, no setup, no data leaves your browser — see Privacy below.\n\nEvery Node.js project accumulates ghosts: deprecated packages nobody noticed, duplicates doing the same job, bloated bundles dragging down load times, licenses that conflict with yours, and ancient major versions three generations behind. These spirits hide in plain sight inside `package.json`, haunting your build long after anyone remembers inviting them in.\n\nThe invoicing-app fix is `npm audit`, which covers CVEs but not the slow rot — the functional duplicate you installed because you forgot you already had one, the 200kB library you pulled in for a function that ships with Node, the package whose last commit was in 2022. **Exorcist** catches those.\n\n**Fully local.** Your `package.json` never leaves your machine. The ML model downloads once and runs in the browser tab via WebAssembly. No…\n\n```\ngit clone https://github.com/ibrahim-iqbal/exorcist-hf26-wk4.git\ncd exorcist-hf26-wk4\nnpm install\nnpm run dev\n```\n\nMIT licensed. Architecture and the full scan pipeline are written up in\n\n`docs/DESIGN.md`\n\nif you want the \"how it actually works\" version instead of the pitch.\n\nThe stack: React 19, TypeScript, Vite 8, Tailwind v4 for utility spots, and a\n\nhand-built CSS theming layer (custom properties, no CSS-in-JS) for the poster\n\nUI. Framer Motion and plain CSS keyframes handle the atmosphere — drips,\n\nembers, the cursor-following lantern.\n\nThe scan runs entirely in the browser in seven stages:\n\nEach stage reports progress so the UI can animate the summoning circle in\n\nreal time. If any stage fails (model can't load, registry unreachable), the\n\npipeline degrades gracefully — the checks that needed that data are skipped,\n\nand the rest still run.\n\n[EmbeddingGemma 300M](https://huggingface.co/nickmuchi/EmbeddingGemma-300M-ONNX)\n\n— Google's open-weight embedding model from the Gemma family, running\n\nentirely in-browser via [Transformers.js](https://huggingface.co/docs/transformers.js)\n\non ONNX Runtime WebAssembly. No API key, no inference server, no per-request\n\ncost. It does two genuine jobs that keyword matching can't:\n\n`lodash` and `underscore` share almost no words\nin their descriptions, but they're functionally the same thing. Exorcist\nembeds every package's npm description and flags pairs above an 82%\ncosine-similarity threshold.`request` is deprecated, it can\nsurface `axios` or `node-fetch` based on what the package actually does.\nIf the model can't load — offline, low memory, an older browser without\n\nWebAssembly SIMD — the scan degrades gracefully. Those two checks get skipped\n\nand the other five still run. No crash, no blank screen.\n\nThe rest of the pipeline (npm registry lookups, Bundlephobia bundle-size\n\nchecks, the scoring model) is plain TypeScript with no AI involved — the\n\nmodel earns its place for the two checks that genuinely need semantic\n\nunderstanding, not because \"AI\" sounded good on a feature list.\n\nBecause `package.json` is basically a map of your stack, your exposure, and\n\nhow far behind you are on patches — and I didn't want to ask anyone to upload\n\nthat to a server to find out if their dependencies were rotten.\n\nAn open-weight model running client-side means:\n\nOpen-weight models made this flow possible without those tradeoffs. That's\n\nthe whole pitch for \"open innovation\" here: the intelligence lives where the\n\ndata already is, instead of the data having to travel to where the\n\nintelligence is.\n\nThe moment Exorcist stopped feeling like a side project and started feeling\n\nlike a real tool was the first time I ran it on one of my own production\n\n`package.json` files — not the demo, not a test fixture, a project I\n\nactually ship.\n\nIt found `request`. Deprecated since 2020. Still in my dependencies. I knew\n\n`request` was deprecated — I'd read the notice years ago — but it was still\n\nthere, still being installed, still adding weight to every `npm install`,\n\nbecause no scan I normally run flags \"deprecated but functional.\" I'd walked\n\npast that ghost every day without seeing it.\n\nThen it found that `lodash` and `underscore` were both installed. Different\n\nparts of the codebase pulled them in at different times. They do essentially\n\nthe same thing. Nobody noticed because the duplicate isn't visible in a\n\nlockfile diff or a bundle report — you only see it if you compare what the\n\npackages *do*, not what they're *named*. That's the check that needs\n\nembeddings, and that's why I built it.\n\nExorcist is a tool for the kind of technical debt that hides in plain sight:\n\nnot security vulnerabilities or breaking changes, but the slow accumulation\n\nof things that stopped being the right choice sometime between when you\n\ninstalled them and now. The ghosts in your dependency tree aren't dramatic.\n\nThey're just quietly making everything a little heavier, a little slower, a\n\nlittle harder to maintain — and nobody exorcises them because nobody looks.\n\nNow something does.\n\n`render.yaml`, building from\nsource on every push.\n*Built for Hacktoberfest 2026, Week 4: Ghost in the Machine.*", "url": "https://wpnews.pro/news/exorcist-a-ghost-hunter-for-your-package-json", "canonical_source": "https://dev.to/ibrahimiqbal/exorcist-a-ghost-hunter-for-your-packagejson-4oij", "published_at": "2026-10-29 07:08:46+00:00", "updated_at": "2026-10-29 07:16:58.443363+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "machine-learning", "ai-products"], "entities": ["Exorcist", "Google", "EmbeddingGemma 300M", "Transformers.js", "ONNX Runtime", "GitHub", "React", "Vite"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/exorcist-a-ghost-hunter-for-your-package-json", "markdown": "https://wpnews.pro/news/exorcist-a-ghost-hunter-for-your-package-json.md", "text": "https://wpnews.pro/news/exorcist-a-ghost-hunter-for-your-package-json.txt", "jsonld": "https://wpnews.pro/news/exorcist-a-ghost-hunter-for-your-package-json.jsonld"}}