GCVE-110-OSM-2026-13874

The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the URL is not embedded in the package. It is likely a continuation of the coin-mining campaign 2026-10-voxeval which used similar wording. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-emberlytts Reasons (based on the campaign): - other - Downloads and executes a remote malicious script. ENTRY voltswannts/__init__.py (module-import: 37) DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in voltswannts/__init__.py: "urllib.request.Request(" ADDITIONAL FINDINGS - Dynamic Code Execution in voltswannts/__init__.py: "compile(src, url, 'exec')" PAYLOAD FILES voltswannts/__init__.py