GCVE-110-OSM-2026-13960

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-voice-synthesis-profiles Reasons (based on the campaign): - Downloads and executes a remote malicious script. - other Judge assessment: The package implements a remote code loader disguised as a 'voice-synthesis profile runner': on import or explicit call, it fetches arbitrary Python source from a caller-supplied URL and executes it in-process via exec(compile(...)). The example URL in the docstring points to a remote eval endpoint, confirming the fetched content is intended to be executed code rather than data. The library is deliberately designed to accept any URL at runtime, making it a generic remote code execution primitive. The package description, metadata (brand-new single-version account with no repository), and the campaign pattern described in the OSV advisory all corroborate coordinated placement of loader stubs. The attacker model is: ship a benign-looking library that embeds a remote-payload executor, then supply malicious profile URLs at deployment time. ENTRY brummatts/__init__.py (module-import: 58) DESTINATION - 1 fetched-payload (urls) (values recorded in verified_iocs) EXFIL - Network Request in brummatts/__init__.py: "urllib.request.urlopen(" ADDITIONAL FINDINGS - Dynamic Code Execution in brummatts/__init__.py: "compile(src, mod.__file__, "exec")" PAYLOAD FILES brummatts/__init__.py