GhostPack is a dependency confusion scanner written in Go. It helps security researchers and developers identify potential dependency confusion vulnerabilities by scanning subdomains for exposed package.json or yarn.lock files and cross-referencing dependencies with the public NPM registry.
- Multi-Path Discovery: Probes for dependency files in common locations (
/package.json,/app/package.json, etc.). - Smart Parsing: Extracts dependencies from both
package.jsonandyarn.lock. - Vulnerability Analysis: Checks
registry.npmjs.orgto identify internal packages that are unclaimed on the public registry (404 Not Found), which are susceptible to dependency confusion attacks. - Protocol Agnostic: Automatically handles subdomains without protocols by defaulting to
http://. - Concurrent Scanning: Highly parallelized execution with a configurable worker pool to prevent IP bans.
- Secure Custom Headers: Supports custom headers (e.g., Authorization tokens) that are safely scoped only to the target domain scans and are never leaked to the NPM registry.
go install github.com/byteoverride/ghostpack@latest GhostPack reads a list of subdomains from stdin and outputs results to stdout.
cat subdomains.txt | ghostpack# Scan with 50 concurrent workers and custom headers
cat subdomains.txt | ./ghostpack -w 50 -H "Authorization: Bearer <token>" -H "Cookie: session=123"
# Scan a single target with verbose output
./ghostpack -u https://example.com -v| Flag | Description | Default |
|---|---|---|
-w |
Number of concurrent workers | 20 |
-u |
Single target URL/Domain to scan | None |
-v |
Enable verbose output | False |
-H |
Custom header (can be used multiple times) | None |
- [FOUND]: A dependency file was discovered.
- [SAFE]: The package exists on the public NPM registry.
- [VULNERABLE]: The package returns a 404 on the public NPM registry, indicating it may be an internal package susceptible to substitution.
[FOUND] example.com | Found https://example.com/package.json
[SAFE] example.com | https://example.com/package.json | Package: react
[VULNERABLE] example.com | https://example.com/package.json | Package: @internal/secret-pkg
This tool is for educational and authorized security testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. The developer assumes no liability and is not responsible for any misuse or damage caused by this program.
MIT License