GCVE-110-OSM-2026-13961

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-voice-synthesis-profiles Reasons (based on the campaign): - other - Downloads and executes a remote malicious script. Judge assessment: The package implements a remote code loader: on import or explicit call, `fetch()` downloads an arbitrary Python file from a caller-supplied URL (or the `ACOUSTICHUB_URL` environment variable), writes it to a temp directory, and executes it via `exec(compile(...))` in a dynamically created module. This is a classic loader/dropper pattern — the package itself carries no payload, but it provides a fully functional mechanism to fetch and execute attacker-controlled code at runtime. The IOC extracted by the scanner (`https://example/internal/plugin.py`) is a placeholder in the docstring, meaning the actual payload URL is supplied by the attacker at call time, making static detection of the final stage impossible. The package has no description, no repository, and no legitimate use case that would justify publishing a dependency-free remote-exec loader to PyPI. The OSV advisory corroborates membership in a coordinated campaign of similar loader packages. ENTRY acoustichub/__init__.py (module-import: 53) DESTINATION - 1 fetched-payload (urls) (values recorded in verified_iocs) EXFIL - Network Request in acoustichub/__init__.py: "urllib.request.urlopen(" ADDITIONAL FINDINGS - Dynamic Code Execution in acoustichub/__init__.py: "compile(source, mod.__file__, "exec")" PAYLOAD FILES acoustichub/__init__.py