Skip to content

v1.4.6

Choose a tag to compare

View all tags
@simonsigre simonsigre released this 29 Nov 07:59
· 2 commits to main since this release
v1.4.6
f842f66

PyGremlinBox Logo

PyGremlinBox v1.4.6

PyGremlinBox is a comprehensive collection of Python packages designed for supply chain security testing and policy compliance evaluation. The project comprises seventy-one independent, self-contained modules: sixty-five licence-focused packages implementing different software licences, and six malware simulation packages containing benign code with strategically placed malicious URL indicators for tabletop exercises.

Whats New!

This release significantly expands PyGremlinBox from 71 packages, adding comprehensive licence coverage and a new category of malware simulation packages for supply chain security testing.

LICENCE PACKAGES (65 total, +44 new):

Added strong copyleft licences:

  • AGPL-1.0, AGPL-1.0-only, AGPL-1.0-or-later variants
  • SSPL-1.0

Added weak copyleft licences:

  • EPL-1.0, LGPL-2.0, MPL-1.1, EUPL-3.0
  • CERN-OHL-S-2.0, CERN-OHL-W-2.0
  • copyleft-next-0.3.0, copyleft-next-0.3.1

Added permissive licences:

  • Artistic-1.0, Arphic-1999, FDK-AAC
  • QPL-1.0-INRIA-2004
  • Various Creative Commons SA variants

Added non-permissive licences:

  • PolyForm-Small-Business-1.0.0, CDLA-Sharing-1.0
  • JPL-image
  • Various Creative Commons NC/ND variants

MALWARE SIMULATION PACKAGES (6 new):

New package category for tabletop exercises with benign code
containing strategically placed malicious URL indicators:

  • pygremlinbox-malware-network-indicators
  • pygremlinbox-malware-c2-beacon
  • pygremlinbox-malware-code-obfuscation
  • pygremlinbox-malware-install-execution
  • pygremlinbox-malware-credential-harvesting
  • pygremlinbox-malware-cryptomining-indicators

Attack vector categories covered:

  • Network communication patterns (HTTP/HTTPS endpoints)
  • Command-and-control beacons (WebSocket channels)
  • Code obfuscation (hidden path URLs)
  • Install-time execution (installer/dropper URLs)
  • Credential harvesting (SSH/SFTP URLs)
  • Cryptomining indicators (FTP/FTPS URLs)

SPDX COMPLIANCE CORRECTIONS:

  • Fixed GPL-2.0, GPL-3.0, AGPL-3.0, LGPL-2.1, LGPL-3.0 identifiers
  • Removed incorrect -only suffixes from base licence packages
  • All 71 packages validated against official SPDX licence list

All 71 packages tested and validated for PyPI + deps.dev publication.

Purpose and Use Cases

PyGremlinBox packages serve as controlled test subjects for evaluating supply chain security infrastructure, including:

Licence Package Use Cases:

  • Dependency Scanning Tools - Validate detection of licensing policies across the dependency tree
  • Security Policy Enforcement - Test compliance systems' ability to identify and flag prohibited licences
  • SPDX Compliance Testing - Verify correct interpretation of SPDX licence identifiers and metadata
  • Supply Chain Analysis - Assess tools' capability to classify and report on licence obligations
  • Continuous Integration Pipelines - Create test scenarios for automated licence compliance checks

Malware Simulation Package Use Cases:

  • Threat Detection Testing - Validate security tools' ability to identify suspicious package naming patterns
  • URL Reputation Systems - Test detection of known malicious infrastructure URLs
  • Tabletop Exercises - Conduct realistic supply chain attack scenario walkthroughs
  • Security Awareness Training - Demonstrate common attack vector patterns in controlled environments
  • Incident Response Drills - Practice response procedures using benign test packages

Package Locations:

Assets 2
Loading