--- title: Finding unused and ghost dependencies with Knip | daily.dev description: JavaScript and TypeScript projects accumulate unused and ghost (phantom) dependencies over time, creating security risks and fragile builds. Knip is a... canonical: https://daily.dev/posts/finding-unused-and-ghost-dependencies-with-knip-jqhpxviau twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Finding unused and ghost dependencies with Knip | daily.dev og:description: JavaScript and TypeScript projects accumulate unused and ghost (phantom) dependencies over time, creating security risks and fragile builds. Knip is a... og:url: https://daily.dev/posts/finding-unused-and-ghost-dependencies-with-knip-jqhpxviau og:image: https://api.daily.dev/og/posts/jqHpXVIAu.png og:image:alt: Finding unused and ghost dependencies with Knip og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Finding unused and ghost dependencies with Knip **[LogRocket](https://daily.dev/sources/logrocket)** · 11 min read · 1 upvotes · 0 comments ## Summary JavaScript and TypeScript projects accumulate unused and ghost (phantom) dependencies over time, creating security risks and fragile builds. Knip is a project-level linter that analyzes the entire repository graph to detect unused dependencies, unlisted (ghost) dependencies, dead files, and unused exports. The post covers how to install and run Knip, filter results by issue type, use --fix carefully, configure ignore rules for intentional exceptions, and integrate Knip into GitHub Actions CI with a gradual rollout strategy — treating ghost dependencies as strict failures while warning on unused ones. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is a ghost dependency in a JavaScript or TypeScript project? A ghost dependency, also called a phantom or unlisted dependency, is a package that code imports directly even though it is not declared in package.json. This typically happens when a transitive dependency is hoisted into node_modules by another package. The build can work fine for months until the parent dependency changes or removes that package, breaking the app unexpectedly. _Track down risky undeclared imports before they cause a production break by exploring dependency hygiene tooling on daily.dev._ ### How do I use Knip to find ghost dependencies in my codebase? Run npx knip --include unlisted to scope the report specifically to ghost or unlisted dependencies, which Knip treats as the highest-risk category. Knip analyzes entry points, imports, and exports across the repository and compares them against package manifests, flagging any package that code imports but package.json does not declare, such as server-only in a real audit of the dub.co project. _Developers auditing dependency graphs for hidden risk can find more workflows like this on daily.dev._ ### How should I roll out Knip checks in CI without breaking every pull request? Treat ghost dependencies as strict and unused dependencies as advisory during rollout: run npx knip --include unlisted as a hard failing step, then run npx knip --include dependencies --no-exit-code so unused-dependency warnings surface without blocking the pipeline. This staged approach lets teams fix undeclared imports immediately while cleaning up unused packages gradually. _Teams designing gradual dependency-hygiene rollouts in CI can find similar workflow patterns on daily.dev._ ## Similar posts on daily.dev - [Dependency Pruning](https://daily.dev/posts/dependency-pruning-5pndtbl58) · Andrew Nesbitt · 0 upvotes · 0 comments - [Is your Node.js project really secure?](https://daily.dev/posts/is-your-node-js-project-really-secure--3o0qagccb) · InfoWorld · 0 upvotes · 0 comments - [Why npm dependencies are a bigger security risk than your code](https://daily.dev/posts/why-npm-dependencies-are-a-bigger-security-risk-than-your-code-zyi7hulam) · LogRocket · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#javascript](https://daily.dev/tags/javascript), [#typescript](https://daily.dev/tags/typescript) [View this post on daily.dev](https://daily.dev/posts/finding-unused-and-ghost-dependencies-with-knip-jqhpxviau) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Finding unused and ghost dependencies with Knip","url":"https://daily.dev/posts/finding-unused-and-ghost-dependencies-with-knip-jqhpxviau","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/finding-unused-and-ghost-dependencies-with-knip-jqhpxviau"},"datePublished":"2026-07-13T14:32:24.216Z","dateModified":"2026-09-13T19:51:51.124Z","description":"JavaScript and TypeScript projects accumulate unused and ghost (phantom) dependencies over time, creating security risks and fragile builds. Knip is a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0861953a52d8fcbb78153c3dcdfb7bd9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0861953a52d8fcbb78153c3dcdfb7bd9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"LogRocket","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"LogRocket","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/logrocket","url":"https://daily.dev/sources/logrocket"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/finding-unused-and-ghost-dependencies-with-knip-jqhpxviau","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,javascript,typescript","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"LogRocket","item":"https://daily.dev/sources/logrocket"},{"@type":"ListItem","position":3,"name":"Finding unused and ghost dependencies with Knip"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/finding-unused-and-ghost-dependencies-with-knip-jqhpxviau#faq","mainEntity":[{"@type":"Question","name":"What is a ghost dependency in a JavaScript or TypeScript project?","acceptedAnswer":{"@type":"Answer","text":"A ghost dependency, also called a phantom or unlisted dependency, is a package that code imports directly even though it is not declared in package.json. This typically happens when a transitive dependency is hoisted into node_modules by another package. The build can work fine for months until the parent dependency changes or removes that package, breaking the app unexpectedly. Track down risky undeclared imports before they cause a production break by exploring dependency hygiene tooling on daily.dev."}},{"@type":"Question","name":"How do I use Knip to find ghost dependencies in my codebase?","acceptedAnswer":{"@type":"Answer","text":"Run npx knip --include unlisted to scope the report specifically to ghost or unlisted dependencies, which Knip treats as the highest-risk category. Knip analyzes entry points, imports, and exports across the repository and compares them against package manifests, flagging any package that code imports but package.json does not declare, such as server-only in a real audit of the dub.co project. Developers auditing dependency graphs for hidden risk can find more workflows like this on daily.dev."}},{"@type":"Question","name":"How should I roll out Knip checks in CI without breaking every pull request?","acceptedAnswer":{"@type":"Answer","text":"Treat ghost dependencies as strict and unused dependencies as advisory during rollout: run npx knip --include unlisted as a hard failing step, then run npx knip --include dependencies --no-exit-code so unused-dependency warnings surface without blocking the pipeline. This staged approach lets teams fix undeclared imports immediately while cleaning up unused packages gradually. Teams designing gradual dependency-hygiene rollouts in CI can find similar workflow patterns on daily.dev."}}]} ```