@gocortexio/npmgremlinbox-typosquat-axios

This is a benign GremlinBox supply chain security simulation package. It performs no malicious action. Unlike the licence packages in this project, it includes an install-time hook that makes a single harmless network request when the package is installed, described under Install-time network telemetry below. It is safe to install into a controlled test environment to validate detection tooling.

Purpose

This package simulates a typosquat of the axios package. It is published under a clearly namespaced GremlinBox name; the misspelling it represents is axois-http. It is intended for testing name-proximity detection in dependency scanners and package audit tools. The package also emits an install-time beacon, described below.

Installation

npm install @gocortexio/npmgremlinbox-typosquat-axios

Usage

const pkg = require('@gocortexio/npmgremlinbox-typosquat-axios');

pkg.getPackageMetadata();

Install-time network telemetry

When this package is installed, an install-time hook makes a single HTTP GET request to None. The request sends only a User-Agent of GremlinBox and carries no payload. No data is collected beyond what a standard HTTP server log records, the request fails silently if the endpoint is unreachable, and it runs no other code. This is deliberate: it demonstrates install-time execution so that tools which monitor outbound requests during installation can detect it. This is the only network activity the package performs, and it occurs at install time only.

What it does and does not do

• Does: expose its typosquat target and simulated variant and package metadata, and emit the install-time beacon described above.
• Does not: contact any third-party endpoint, collect data, or run any code beyond the single install-time beacon request.

Project

Part of the GremlinBox supply chain security testing project: https://github.com/gocortexio/gremlinbox

Licence

AGPL-3.0-or-later. See the LICENCE file in this package.