ghostnode

Built by DARKSOL

ghostnode is a privacy firewall for Node.js apps.

It inspects outbound boundaries and helps you detect, redact, or block sensitive data before it leaves your process.

Think:

• HTTP requests
• logs
• analytics and telemetry payloads
• AI and agent calls
• debug output

Install

npm install ghostnode

Quick Start

import { installGhostNode } from "ghostnode";

installGhostNode({
  mode: "audit",
  includePreview: true,
  onEvent(event) {
    console.error("GhostNode detected a potential data leak", event);
  }
});

You can also preload it automatically:

GHOSTNODE=audit node app.js

Or scan an app from the outside:

npx ghostnode scan -- node server.js

Or emit a machine-readable report:

npx ghostnode scan --mode audit --report ghostnode-report.json -- node server.js

Modes

• audit: detect and report leaks, but allow the original operation
• redact: sanitize detected data, then allow the original operation
• block: stop the operation when a leak is detected

Boundaries

GhostNode currently covers:

• fetch
• console
• generic logger objects
• pino through createPinoLogger(...)
• winston through createWinstonLogger(...)

Logger Adapters

import { createPinoLogger, createWinstonLogger } from "ghostnode";

const safePino = createPinoLogger(pinoLogger, { mode: "redact" });
const safeWinston = createWinstonLogger(winstonLogger, { mode: "audit" });

HTTP Helpers

import { createFetchProxy, sanitizeRequest } from "ghostnode";

const safeFetch = createFetchProxy({
  mode: "redact",
  onRequest(request) {
    console.log("outbound request", request);
  }
});

const sanitized = sanitizeRequest("https://[email protected]", {
  headers: {
    authorization: "Bearer token-value"
  }
});

What It Detects

Built-in detectors cover:

• emails
• IP addresses
• bearer tokens
• API keys
• JWTs
• cookies
• passwords
• payment-card-like values

You can also add custom secrets and custom sensitive-key rules.

Structured Events

Every detection can emit a structured event with:

• boundary
• destination
• findings
• severity
• action
• optional sanitized preview data when includePreview: true

That gives you something useful for logging, tests, CI, and incident review instead of a vague boolean.

Scan Reports

ghostnode scan can write JSON output with severity counts and full event detail:

npx ghostnode scan --mode audit --report ghostnode-report.json -- node app.js

Promise

The promise stays simple:

GhostNode detects sensitive data leaving your Node.js application.

Translation Note

Translations are welcome.

The main README stays compact in English, and full translations live under docs/i18n/.

Direction

Strong next expansions:

• source-aware leak tracing
• telemetry and error-reporter integrations
• richer policy controls and severity thresholds
• more first-class outbound adapters

GhostNode Your data was never there.