GremlinBox is a collection of packages published across multiple package ecosystems for supply chain security testing and policy compliance evaluation.
View project on GitHubMaintained by GoCortex, an independent publisher of open-source tooling for the Palo Alto Networks Cortex platform.
GremlinBox is a collection of packages published across multiple package ecosystems for supply chain security testing and policy compliance evaluation. The packages are designed to exercise the detection capabilities of dependency scanners, licence enforcement tools, and supply chain security platforms in controlled tabletop exercises and pipeline validation runs.
Licence packages cover the full spectrum of software licensing models. Each package implements a single SPDX-compatible licence, embedding the official licence text and exporting the correct SPDX identifier. The collection spans strong copyleft, weak copyleft, permissive, and non-permissive licences, including Creative Commons variants, hardware licences, and source-available licences.
These packages are intended for testing licence detection and policy enforcement tools. A scanner that inspects transitive dependencies should detect all licence categories represented in the collection.
The site is independently operated and is in no way endorsed or supported by Palo Alto Networks.