GCVE-110-OSM-2026-13965

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-voice-synthesis-profiles Reasons (based on the campaign): - other - Downloads and executes a remote malicious script. Judge assessment: The package implements a remote code loader as its core, sole functionality: on import or explicit call, it fetches an arbitrary Python source file from a caller-supplied URL (or BENCHBRIDGE_URL env var), compiles it, and executes it in-process via exec(compile(...)). The docstring itself uses 'https://example/internal/profile.py' as the canonical usage example, which is the IOC extracted by the scanner. This is a textbook loader-as-a-library pattern used in supply-chain campaigns: the package carries no malicious payload itself but provides a ready-made, retry-hardened, in-process execution mechanism for whatever remote Python the attacker serves. Minimal metadata (no description, no repository, no author) combined with the complete absence of any legitimate benchmarking logic — only the fetch-compile-exec pipeline — confirms this is not a real utility. The OSV advisory's characterization of a coordinated loader campaign is consistent with what the code demonstrates. ENTRY benchbridge/__init__.py (module-import: 53) DESTINATION - 1 fetched-payload (urls) (values recorded in verified_iocs) EXFIL - Network Request in benchbridge/__init__.py: "urllib.request.urlopen(" ADDITIONAL FINDINGS - Dynamic Code Execution in benchbridge/__init__.py: "compile(source, mod.__file__, "exec")" PAYLOAD FILES benchbridge/__init__.py