Repository navigation
Releases: FGuerreir0/ghostimport
Release list
v0.6.0
Full Changelog: v0.5.2...v0.6.0
v0.5.2
v0.5.1
v0.5.0
Scanning is now deep by default, and the "scary" vocabulary is gone. The CLI is backward compatible; the library API is not.
Why the rename
A security tool with a --scary flag reads as a toy — and worse, the flag hid the most valuable check (is this hallucinated name still unregistered, and therefore free for an attacker to claim?) behind an opt-in nobody turned on. That check now runs by default.
CLI
- The unregistered-name and typosquat checks run by default.
--scaryis no longer needed and is silently accepted, so existing scripts keep working. - New
--fastopts out of the expensive registry layer when you only want existence checks.
Breaking: library API
Public exports cut from 11 to 7. Internals are still importable from their module paths (ghostimport/dist/files, etc.) but are no longer part of the supported surface.
Removed from the public API: extractSfcScripts, loadCache, saveCache, loadConfig, walkFiles, readPackageJsonDeps, and the CacheEntry type.
Added: verifyPackages (the shared name-list layer the CLI, MCP server and hook all use) and extractInstallTargets (pulls packages out of an npm/pnpm/yarn/bun install command).
Renamed:
| v0.4.0 | v0.5.0 |
|---|---|
checkScary() |
checkPackageRisk() |
ScaryEntry |
RiskEntry |
ScaryCheckResult |
PackageRiskResult |
ScanResult.hallucinated |
ScanResult.missing |
ScanResult.notInPackageJson |
ScanResult.undeclared |
ScanResult.scary |
ScanResult.risks |
ScanOptions.scary |
ScanOptions.deep (now defaults to true) |
status 'hallucinated' |
status 'missing' |
RiskEntry.type: 'available' |
RiskEntry.type: 'unregistered' |
JSON output from the CLI follows the same field renames.
Also
- This is the first release published from CI with a SLSA provenance attestation via npm Trusted Publishing.
- Types are generated from source by
tscrather than handwritten. - Still zero runtime dependencies, including the MCP server.