@gocortexio/npmgremlinbox-malware-cryptomining-indicators

This is a benign GremlinBox supply chain security simulation package. It performs no malicious action. Unlike the licence packages in this project, it includes an install-time hook that makes a single harmless network request when the package is installed, described under Install-time network telemetry below. It is safe to install into a controlled test environment to validate detection tooling.

Purpose

This package represents the cryptomining indicators attack category. It contains benign code with strategically placed indicator URLs that security tools should detect. The indicator URLs are held as data only; they are never contacted, decoded, or executed. The package also emits an install-time beacon, described below.

Installation

npm install @gocortexio/npmgremlinbox-malware-cryptomining-indicators

Usage

const pkg = require('@gocortexio/npmgremlinbox-malware-cryptomining-indicators');

pkg.getPackageMetadata();

Install-time network telemetry

When this package is installed, an install-time hook makes a single HTTP GET request to https://gremlinbox.sigre.xyz/install/cryptomining-indicators. The request sends only a User-Agent of GremlinBox and carries no payload. No data is collected beyond what a standard HTTP server log records, the request fails silently if the endpoint is unreachable, and it runs no other code. This is deliberate: it demonstrates install-time execution so that tools which monitor outbound requests during installation can detect it. This is the only network activity the package performs, and it occurs at install time only.

What it does and does not do

• Does: expose its indicator URLs and attack category as inert data and package metadata, and emit the install-time beacon described above.
• Does not: contact the indicator URLs, collect data, exfiltrate anything, or run any code beyond the single install-time beacon request.

Project

Part of the GremlinBox supply chain security testing project: https://github.com/gocortexio/gremlinbox

Licence

AGPL-3.0-or-later. See the LICENCE file in this package.