GHOST - Global Human Operations & Surveillance Tracking: Open-source investigation management platform for tracking people, connections, and intelligence data. Because Excel spreadsheets are for accountants, not investigators. Non-commercial license.
Investigators and researchers tracking people, connections, and intelligence data typically fall back on spreadsheets, which collapse under relational complexity. GHOST addresses this with a self-hosted investigation management platform that models people, entities, locations, and their relationships in a structured, queryable system instead of flat rows.
What This Does
GHOST is a full-stack OSINT investigation CRM. The frontend/ directory (React, TypeScript, Tailwind) provides the interface: case management, entity network visualization, and a geocoded global map. The backend/ directory (Node.js/Express) exposes the API, handles authentication, rate limiting, and database persistence.
The project is a collection of four self-contained components: frontend/, backend/, .agents/ (an AI-agent skill library with design and coding reference material), and mcp/ (a Model Context Protocol server). They are not one unified codebase.
How It Is Wired
Execution starts at backend/server.js, which loads Express middleware and routes. The backend connects to a database via backend/config/database.js (imported by 21 modules) and enforces auth via backend/middleware/auth.js (20 importers). The frontend routes all API calls through frontend/src/utils/api.js — a hub module with 43 dependents, meaning any change there ripples across the entire UI.
The frontend's src/App.js imports 34 modules and sits at the top of the component tree. src/contexts/DataContext.js (17 dependents) manages shared state. Key feature files include src/components/CaseManagement.js, src/components/GlobalMap.js, and src/components/visualization/RelationshipManager.js (860 lines — oversized).
The import graph shows 166 modules with 389 edges and no circular dependencies, which is structurally clean. The main cost centers are the hub modules: api.js, database.js, and auth.js have near-zero instability, meaning they're stable but any change is high-blast-radius.
How To Use It
Setup: Clone with git clone https://github.com/moses-y/GHOST-osint-crm. Install dependencies: npm install in both backend/ and frontend/. Docker builds exist (backend/Dockerfile, frontend/Dockerfile, docker-compose.yml).
Configuration: Copy .env.example to .env in both backend/ and frontend/. Required variables include database connection strings, JWT secrets, and API keys (WiGLE integration). The frontend .env is currently committed — this is a security issue.
Running it: Start the backend with node backend/server.js and the frontend with npm start in frontend/. The docker-compose.yml orchestrates both plus PostgreSQL.
Real-World Use
A solo investigator tracking a human trafficking network imports suspect profiles, links associates via the entity graph, geocodes known locations onto the map, and queries the WiGLE integration for wireless network intelligence at those coordinates. Case data persists in PostgreSQL, and the React frontend renders the relationship map in real time.
Code Health & Issues
Static analysis found 73 issues (10 high, 63 medium) across five kinds. Key findings:
High — Hub modules: frontend/src/utils/api.js, backend/config/database.js, backend/middleware/auth.js have 20-43 dependents each; changes here are high-blast-radius.
High — Deep nesting: 26 files with indentation depth up to 10, including backend/routes/tools.js and frontend/src/components/CaseManagement.js.
High — Duplicated code: 84 repeated 6-line blocks across 43 files in .agents/skills/impeccable/scripts/.
High — Oversized files: 6 files over 860 lines, including RelationshipManager.js.
Code health audit (13 findings, 6 high):
High — Committed .env file (frontend/.env) that .gitignore excludes; rotate credentials immediately.
High — 41,244 files committed under node_modules; reinstall from lockfile and untrack.
High — GitHub Actions pinned to mutable tags (@v3, @v5) instead of commit SHAs.
High — No test command in CI despite 13 test files.
Medium — No Dependabot/Renovate configured.
Medium — Base image node:18-alpine not pinned by digest.
The Bottom Line
GHOST is a functional, self-hosted investigation CRM with genuine depth in entity modeling and visualization. The committed node_modules and .env are serious hygiene failures that must be fixed before any real deployment. Suitable for individual researchers and hobbyists who control their infrastructure and accept operator responsibility for security.
What the analyser found
Deployment readiness
6/7
✓Container image
✓CI pipeline
✓Lockfile committed
✓Test suite
✓README
✓License
✗No committed secrets
Composition
41,586 files
JavaScript26067
TypeScript4373
Markdown2196
JSON1988
YAML205
CSS30
ReactFlaskExpressTailwindDockerPyTorchTransformersVector store
Module dependencies
The 10 most depended-upon modules of 166, from static import analysis. Red outline marks a module in an import cycle.
Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.
high6
medium6
low1
Untrack the file your own .gitignore says to ignorehigh
frontend/.env
tracked although .gitignore excludes it
The author already decided this file must never be committed, so its presence is an accident nobody noticed, which means the credentials in it are the ones actually in use.
Fix: git rm --cached the path and rotate; the ignore rule is already correct.
Remove the committed dependency directoryhigh41244 occurrences
node_modules
41244 files committed under node_modules
The code that actually runs was never resolved from a manifest, so no scanner, lockfile or update bot has any view of it.
Fix: Gitignore the directory, git rm -r --cached it, and reinstall from the lockfile.
Pin third-party GitHub Actions to a commit SHAhigh4 occurrences
A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.
Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.
Commit a lockfile beside the manifesthigh
mcp/package.json
manifest with no lockfile in scope
An unlocked range means the artifact you tested and the artifact you ship can contain different transitive code, so a malicious patch release reaches production with no diff.
Fix: Run the package manager once and commit the generated lockfile.
Remove the committed .env and rotate what it holdshigh
frontend/.env
frontend/.env
A tracked .env is the most common route for a working key to reach a public clone, and it is the file the app actually loads, so the value is usually live.
Fix: git rm --cached the file, add it to .gitignore, rotate every credential it names, commit a .env.example with empty values.
Make CI invoke the test suite it hashigh13 occurrences
.github/workflows
13 test files, no test command in any workflow
A green check that never executed an assertion is worse than no check, because reviewers trust it.
Fix: Add a test step to the existing workflow rather than a new workflow.
Enable Dependabot or Renovatemedium
3 manifest(s), no update bot configured
Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.
Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.
Pin the container base image by digestmedium
backend/Dockerfile
node:18-alpine
An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.
Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.
Gate pull requests on a dependency vulnerability scanmedium
.github/workflows
no dependency scan in CI
This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.
Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.
Add a pre-commit secret gatemedium
a secret-shaped file is tracked and no repo-level gate is visible
Without a gate the same class of leak recurs on the next commit, so a leak finding is the symptom and this is the cause.
Fix: Add a pre-commit hook scanning staged content, and enable push protection.
Move large binaries to Git LFS or out of the repositorymedium6 occurrences
frontend/node_modules/typescript/lib/tsserver.js
6 blobs over 5MB: tsserver.js 11.1MB, tsserverlibrary.js 11.1MB, typescript.js 10.4MB
One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.
Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.
Add a non-root USER to the imagemedium
backend/Dockerfile
CMD or ENTRYPOINT with no USER directive
A process running as root in the container is root against every mounted volume, and it turns any container escape or writable-mount mistake from a contained problem into a host one.
Fix: Create an unprivileged user, chown what it needs, and end the Dockerfile with USER.
1 further finding(s) are listed in the full report.
Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.