v2.0.1

GremlinBox v2.0.1: It Takes a Village (feat. Python, npm, Rust, and some stern words from the PyPI Security Team)

What shipped seven months ago as a 21-package Python curiosity called PyGremlinBox has grown into a proper multi-language supply chain test bench.

Added:

• npm support: NPMGremlinBox with 80 packages (@gremlinbox scope) — 65 licence, 6 malware simulation, 8 typosquat (targeting boto3, colorama, numpy, requests, etc.), and 1 base squatter. Install-time beacons fire via postinstall.js.
• Rust support: RustGremlinBox with 80 crates.io packages — same split, generated by generate.py. Beacons fire via build.rs using minreq and surface output via cargo:warning. Typosquat targets include serde, tokio, clap, rand, reqwest, anyhow, syn, and regex.
• Python grew from 21 to 65 licence packages, with 6 malware simulation packages, 8 typosquat packages, and the gremlinbox PyPI squatter package.
• All hook packages now use AGPL-3.0-or-later across Python, npm, and Rust.

Package Ecosystems

PyGremlinBox (Python)

PyGremlinBox provides the Python implementation of the GremlinBox package collection.

Packages in this sub-project:

• 65 licence packages (pygremlinbox-[licence], e.g. pygremlinbox-gpl-3-0)
• 6 malware simulation packages (pygremlinbox-malware-[category])
• 8 typosquatting packages (published under the typosquat name directly, e.g. reqeusts)
• 1 base squatter package (gremlinbox)

Source: PyGremlinBox/

NPMGremlinBox (Node.js)

NPMGremlinBox provides the Node.js implementation of the GremlinBox package collection.

Packages in this sub-project:

• 65 licence packages (scoped as @gremlinbox/[slug], e.g. @gremlinbox/gpl-3-0)
• 6 malware simulation packages (@gremlinbox/malware-[category])
• 8 typosquatting packages (published under the typosquat name directly, e.g. axois, lodahs)
• 1 base squatter package (@gremlinbox/base)

Source: NPMGremlinBox/

RustGremlinBox (Rust)

RustGremlinBox provides the Rust implementation of the GremlinBox package collection.

Packages in this sub-project:

• 65 licence crates (gremlinbox-[licence], e.g. gremlinbox-gpl-3-0)
• 6 malware simulation crates (gremlinbox-malware-[category])
• 8 typosquatting crates (published under the typosquat name directly, e.g. serd-serialize, tokoi-runtime), targeting popular crates such as serde and tokio
• 1 base squatter crate (gremlinbox)

Each malware simulation and typosquatting crate carries a build.rs install-time beacon hook (see Install-Time Execution above).

Note on the licence field: each licence crate sets license = "<SPDX identifier>" in Cargo.toml so scanners observe the identifier. cargo build does not validate this string; the exotic non-SPDX identifiers would require the license-file field instead only if the crate were published to a registry.

Source: RustGremlinBox/

The corpus is generated from the canonical mapping data and official licence texts by RustGremlinBox/generate.py, and validated by the RustGremlinBox/gremlinbox-tests crate.

v1.4.6

PyGremlinBox v1.4.6

PyGremlinBox is a comprehensive collection of Python packages designed for supply chain security testing and policy compliance evaluation. The project comprises seventy-one independent, self-contained modules: sixty-five licence-focused packages implementing different software licences, and six malware simulation packages containing benign code with strategically placed malicious URL indicators for tabletop exercises.

Whats New!

This release significantly expands PyGremlinBox from 71 packages, adding comprehensive licence coverage and a new category of malware simulation packages for supply chain security testing.

LICENCE PACKAGES (65 total, +44 new):

Added strong copyleft licences:

• AGPL-1.0, AGPL-1.0-only, AGPL-1.0-or-later variants
• SSPL-1.0

Added weak copyleft licences:

• EPL-1.0, LGPL-2.0, MPL-1.1, EUPL-3.0
• CERN-OHL-S-2.0, CERN-OHL-W-2.0
• copyleft-next-0.3.0, copyleft-next-0.3.1

Added permissive licences:

• Artistic-1.0, Arphic-1999, FDK-AAC
• QPL-1.0-INRIA-2004
• Various Creative Commons SA variants

Added non-permissive licences:

• PolyForm-Small-Business-1.0.0, CDLA-Sharing-1.0
• JPL-image
• Various Creative Commons NC/ND variants

MALWARE SIMULATION PACKAGES (6 new):

New package category for tabletop exercises with benign code
containing strategically placed malicious URL indicators:

• pygremlinbox-malware-network-indicators
• pygremlinbox-malware-c2-beacon
• pygremlinbox-malware-code-obfuscation
• pygremlinbox-malware-install-execution
• pygremlinbox-malware-credential-harvesting
• pygremlinbox-malware-cryptomining-indicators

Attack vector categories covered:

• Network communication patterns (HTTP/HTTPS endpoints)
• Command-and-control beacons (WebSocket channels)
• Code obfuscation (hidden path URLs)
• Install-time execution (installer/dropper URLs)
• Credential harvesting (SSH/SFTP URLs)
• Cryptomining indicators (FTP/FTPS URLs)

SPDX COMPLIANCE CORRECTIONS:

• Fixed GPL-2.0, GPL-3.0, AGPL-3.0, LGPL-2.1, LGPL-3.0 identifiers
• Removed incorrect -only suffixes from base licence packages
• All 71 packages validated against official SPDX licence list

All 71 packages tested and validated for PyPI + deps.dev publication.

Purpose and Use Cases

PyGremlinBox packages serve as controlled test subjects for evaluating supply chain security infrastructure, including:

Licence Package Use Cases:

• Dependency Scanning Tools - Validate detection of licensing policies across the dependency tree
• Security Policy Enforcement - Test compliance systems' ability to identify and flag prohibited licences
• SPDX Compliance Testing - Verify correct interpretation of SPDX licence identifiers and metadata
• Supply Chain Analysis - Assess tools' capability to classify and report on licence obligations
• Continuous Integration Pipelines - Create test scenarios for automated licence compliance checks

Malware Simulation Package Use Cases:

• Threat Detection Testing - Validate security tools' ability to identify suspicious package naming patterns
• URL Reputation Systems - Test detection of known malicious infrastructure URLs
• Tabletop Exercises - Conduct realistic supply chain attack scenario walkthroughs
• Security Awareness Training - Demonstrate common attack vector patterns in controlled environments
• Incident Response Drills - Practice response procedures using benign test packages

Package Locations:

• PyPI: https://pypi.org/search/?q=PyGremlinBox
• deps.dev: https://deps.dev/search?q=pygremlinbox
• Repository: https://github.com/gocortexio/pygremlinbox

v1.3.0

PyGremlinBox v1.3.0

PyGremlinBox is a comprehensive container project housing multiple Python modules for supply chain security testing. Each subproject contains different policy implementations that trigger alerts in dependency scanning tools, starting with comprehensive licence coverage, and can be individually published to PyPI.

This release includes the following fixes/improvements:

• Changed from license = {file = "LICENCE"} to license = {text = "SPDX-IDENTIFIER"}
• PKG-INFO files now contain proper SPDX identifiers instead of full license text
• Eliminates "non-standard license" classification by pip-audit and security scanners
• Removed licence_reader.py files from 4 packages (GPL-3-0, EPL-2-0, LGPL-2-1, MPL-2-0)
• Implemented all functions directly in init.py across all packages
• Unified codebase structure for maintainability
• Version bump to 1.3.0 across all 21 packages

Project Overview

This repository contains twenty-two independent Python packages, each distributed under different licence types covering strong copyleft, weak copyleft, permissive, and non-permissive licences. These packages are designed to test the policy detection capabilities of supply chain security tools, with current focus on comprehensive licence coverage.

Package Locations:

• PyPI: https://pypi.org/search/?q=PyGremlinBox
• deps.dev: https://deps.dev/search?q=pygremlinbox

Package Collection

Strong Copyleft Licences

• pygremlinbox-gpl-3-0 - GNU General Public Licence version 3.0
• pygremlinbox-gpl-2-0 - GNU General Public Licence version 2.0
• pygremlinbox-agpl-3-0 - GNU Affero General Public Licence version 3.0
• pygremlinbox-agpl-2-0 - GNU Affero General Public Licence version 2.0

Weak Copyleft Licences

• pygremlinbox-lgpl-3-0 - GNU Lesser General Public Licence version 3.0
• pygremlinbox-lgpl-2-1 - GNU Lesser General Public Licence version 2.1
• pygremlinbox-mpl-2-0 - Mozilla Public Licence version 2.0
• pygremlinbox-epl-2-0 - Eclipse Public Licence version 2.0
• pygremlinbox-eupl-1-2 - European Union Public Licence version 1.2
• pygremlinbox-eupl-1-1 - European Union Public Licence version 1.1
• pygremlinbox-osl-3-0 - Open Software Licence version 3.0
• pygremlinbox-cddl-1-0 - Common Development and Distribution License 1.0

Permissive and Other Licences

• pygremlinbox-cc-by-sa-4-0 - Creative Commons Attribution-ShareAlike 4.0
• pygremlinbox-cc-by-sa-3-0-de - Creative Commons Attribution-ShareAlike 3.0 Germany
• pygremlinbox-apsl - Apple Public Source Licence version 2.0
• pygremlinbox-unlicense - Unlicense (Public Domain)

Non-Permissive Licences

• pygremlinbox-busl-1-1 - Business Source Licence v1.1
• pygremlinbox-c-uda-1-0 - Computational Use of Data Agreement v1.0
• pygremlinbox-hippocratic-2-1 - Hippocratic Licence v2.1
• pygremlinbox-ms-lpl - Microsoft Limited Public Licence
• pygremlinbox-ncgl-uk-2-0 - Non-Commercial Government Licence UK v2.0
• pygremlinbox-polyform-noncommercial-1-0-0 - PolyForm Noncommercial Licence v1.0.0

Purpose and Use Case

These packages serve as controlled test subjects for evaluating supply chain security tools and dependency scanning systems. Each package implements a standardised interface whilst containing policy indicators that should trigger appropriate alerts and classifications in security analysis tools.

Package Interface

Each subproject provides consistent functionality through standardised methods:

• retrieve_licence_content() - Returns the complete licence text as specified in the LICENCE file
• get_licence_identifier() - Returns the standard licence identifier (e.g., "GPL-3.0", "AGPL-2.0")
• get_package_metadata() - Returns comprehensive package metadata including name, version, and licence information

Installation and Usage

Each package can be installed independently from PyPI using standard Python package management tools:

pip install pygremlinbox-gpl-3-0
pip install pygremlinbox-agpl-3-0
# etc.

Once installed, packages can be imported and used for testing purposes:

import pygremlinbox_gpl_3_0 as gpl_test

# Retrieve licence information
licence_id = gpl_test.get_licence_identifier()
licence_text = gpl_test.retrieve_licence_content()
metadata = gpl_test.get_package_metadata()

v1.0.1

PyGremlinBox

PyGremlinBox is a comprehensive container project housing multiple Python modules for supply chain security testing. Each subproject contains different policy implementations that trigger alerts in dependency scanning tools, starting with comprehensive licence coverage, and can be individually published to PyPI.

Project Overview

This repository contains twenty-two independent Python packages, each distributed under different licence types covering strong copyleft, weak copyleft, permissive, and non-permissive licences. These packages are designed to test the policy detection capabilities of supply chain security tools, with current focus on comprehensive licence coverage.

Package Locations:

• PyPI: https://pypi.org/search/?q=PyGremlinBox
• deps.dev: https://deps.dev/search?q=pygremlinbox

Package Collection

Strong Copyleft Licences

• pygremlinbox-gpl-3-0 - GNU General Public Licence version 3.0
• pygremlinbox-gpl-2-0 - GNU General Public Licence version 2.0
• pygremlinbox-agpl-3-0 - GNU Affero General Public Licence version 3.0
• pygremlinbox-agpl-2-0 - GNU Affero General Public Licence version 2.0

Weak Copyleft Licences

• pygremlinbox-lgpl-3-0 - GNU Lesser General Public Licence version 3.0
• pygremlinbox-lgpl-2-1 - GNU Lesser General Public Licence version 2.1
• pygremlinbox-mpl-2-0 - Mozilla Public Licence version 2.0
• pygremlinbox-epl-2-0 - Eclipse Public Licence version 2.0
• pygremlinbox-eupl-1-2 - European Union Public Licence version 1.2
• pygremlinbox-eupl-1-1 - European Union Public Licence version 1.1
• pygremlinbox-osl-3-0 - Open Software Licence version 3.0
• pygremlinbox-cddl-1-0 - Common Development and Distribution License 1.0

Permissive and Other Licences

• pygremlinbox-cc-by-sa-4-0 - Creative Commons Attribution-ShareAlike 4.0
• pygremlinbox-cc-by-sa-3-0-de - Creative Commons Attribution-ShareAlike 3.0 Germany
• pygremlinbox-apsl - Apple Public Source Licence version 2.0
• pygremlinbox-unlicense - Unlicense (Public Domain)

Non-Permissive Licences

• pygremlinbox-busl-1-1 - Business Source Licence v1.1
• pygremlinbox-c-uda-1-0 - Computational Use of Data Agreement v1.0
• pygremlinbox-hippocratic-2-1 - Hippocratic Licence v2.1
• pygremlinbox-ms-lpl - Microsoft Limited Public Licence
• pygremlinbox-ncgl-uk-2-0 - Non-Commercial Government Licence UK v2.0
• pygremlinbox-polyform-noncommercial-1-0-0 - PolyForm Noncommercial Licence v1.0.0

Purpose and Use Case

These packages serve as controlled test subjects for evaluating supply chain security tools and dependency scanning systems. Each package implements a standardised interface whilst containing policy indicators that should trigger appropriate alerts and classifications in security analysis tools.

Package Interface

Each subproject provides consistent functionality through standardised methods:

• retrieve_licence_content() - Returns the complete licence text as specified in the LICENCE file
• get_licence_identifier() - Returns the standard licence identifier (e.g., "GPL-3.0", "AGPL-2.0")
• get_package_metadata() - Returns comprehensive package metadata including name, version, and licence information

Installation and Usage

Each package can be installed independently from PyPI using standard Python package management tools:

pip install pygremlinbox-gpl-3-0
pip install pygremlinbox-agpl-3-0
# etc.

Once installed, packages can be imported and used for testing purposes:

import pygremlinbox_gpl_3_0 as gpl_test

# Retrieve licence information
licence_id = gpl_test.get_licence_identifier()
licence_text = gpl_test.retrieve_licence_content()
metadata = gpl_test.get_package_metadata()