Ghost Libraries

3,000 packages. Checked before you pull them.

The 1,000 most-used packages from each of PyPI, Maven Central, and npm. Each one scanned, with binary provenance analysis and a report you can hand to your ISSM.

Registry

Rank	Package	Registry	Latest	CVE scan	Provenance
#1	boto3The AWS SDK for Python	PyPI	1.43.82	Scanned	Checked
#1	junit:junitJUnit is a unit testing framework for Java, created by Erich Gamma...	Maven Central	4.13.2	Scanned	Checked
#1	semverThe semantic version parser used by npm.	npm	7.8.5	Scanned	Checked
#2	packagingCore utilities for Python packages	PyPI	26.3	Scanned	Checked
#2	org.springframework.boot:spring-boot-starter-testStarter for testing Spring Boot applications with libraries including...	Maven Central	4.1.1	Scanned	Checked
#2	debugLightweight debugging utility for Node.js and the browser	npm	4.4.3	Scanned	Checked
#3	typing-extensionsBackported and Experimental Type Hints for Python 3.9+	PyPI	4.16.0	Scanned	Checked
#3	org.springframework.boot:spring-boot-starter-webStarter for building web, including RESTful, applications using...	Maven Central	4.1.1	Scanned	Checked
#3	minimatcha glob matcher in javascript	npm	10.2.6	Scanned	Checked
#4	certifiPython package for providing Mozilla's CA Bundle.	PyPI	2026.7.22	Scanned	Checked
#4	mysql:mysql-connector-javaNo description published	Maven Central	8.0.33	Scanned	Checked
#4	ansi-stylesANSI escape codes for styling strings in the terminal	npm	7.0.0	Scanned	Checked

Showing 12 of 3,000 packagesLoad more

Pick a registry to see ranks. PyPI and npm are ranked by monthly downloads. Maven Central is ranked by dependent repositories, since it does not publish download counts.

What we check

What Ghost checks in every package.

Each package gets the same three checks, and the results are written up for the people who sign off on your system.

Known vulnerabilities

Each package is scanned for published CVEs, with the results in the report.

Binary provenance

Does the binary you pull match what the source says it should be? We check before it lands in your build.

A report you can hand over

Findings written up in a format your accreditation team can use. Not a raw scanner dump.

3,000 packages. Checked before you pull them.

What Ghost checks in every package.

Known vulnerabilities

Binary provenance

A report you can hand over

Need a package that is not on the list?