Skip to content

v2.0.1

Latest
Latest

Choose a tag to compare

View all tags
@simonsigre simonsigre released this 04 Jul 05:11
v2.0.1
b6f77fe

PyGremlinBox Logo

GremlinBox v2.0.1: It Takes a Village (feat. Python, npm, Rust, and some stern words from the PyPI Security Team)

What shipped seven months ago as a 21-package Python curiosity called PyGremlinBox has grown into a proper multi-language supply chain test bench.

Added:

  • npm support: NPMGremlinBox with 80 packages (@gremlinbox scope) — 65 licence, 6 malware simulation, 8 typosquat (targeting boto3, colorama, numpy, requests, etc.), and 1 base squatter. Install-time beacons fire via postinstall.js.
  • Rust support: RustGremlinBox with 80 crates.io packages — same split, generated by generate.py. Beacons fire via build.rs using minreq and surface output via cargo:warning. Typosquat targets include serde, tokio, clap, rand, reqwest, anyhow, syn, and regex.
  • Python grew from 21 to 65 licence packages, with 6 malware simulation packages, 8 typosquat packages, and the gremlinbox PyPI squatter package.
  • All hook packages now use AGPL-3.0-or-later across Python, npm, and Rust.

Package Ecosystems

PyGremlinBox (Python)

PyGremlinBox provides the Python implementation of the GremlinBox package collection.

Packages in this sub-project:

  • 65 licence packages (pygremlinbox-[licence], e.g. pygremlinbox-gpl-3-0)
  • 6 malware simulation packages (pygremlinbox-malware-[category])
  • 8 typosquatting packages (published under the typosquat name directly, e.g. reqeusts)
  • 1 base squatter package (gremlinbox)

Source: PyGremlinBox/

NPMGremlinBox (Node.js)

NPMGremlinBox provides the Node.js implementation of the GremlinBox package collection.

Packages in this sub-project:

  • 65 licence packages (scoped as @gremlinbox/[slug], e.g. @gremlinbox/gpl-3-0)
  • 6 malware simulation packages (@gremlinbox/malware-[category])
  • 8 typosquatting packages (published under the typosquat name directly, e.g. axois, lodahs)
  • 1 base squatter package (@gremlinbox/base)

Source: NPMGremlinBox/

RustGremlinBox (Rust)

RustGremlinBox provides the Rust implementation of the GremlinBox package collection.

Packages in this sub-project:

  • 65 licence crates (gremlinbox-[licence], e.g. gremlinbox-gpl-3-0)
  • 6 malware simulation crates (gremlinbox-malware-[category])
  • 8 typosquatting crates (published under the typosquat name directly, e.g. serd-serialize, tokoi-runtime), targeting popular crates such as serde and tokio
  • 1 base squatter crate (gremlinbox)

Each malware simulation and typosquatting crate carries a build.rs install-time beacon hook (see Install-Time Execution above).

Note on the licence field: each licence crate sets license = "<SPDX identifier>" in Cargo.toml so scanners observe the identifier. cargo build does not validate this string; the exotic non-SPDX identifiers would require the license-file field instead only if the crate were published to a registry.

Source: RustGremlinBox/

The corpus is generated from the canonical mapping data and official licence texts by RustGremlinBox/generate.py, and validated by the RustGremlinBox/gremlinbox-tests crate.

Assets 2
Loading