GCVE-110-OSM-2026-13971

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-voice-synthesis-profiles Reasons (based on the campaign): - other - Downloads and executes a remote malicious script. Judge assessment: The package implements a remote code loader as its primary and only function: `acquire()` fetches arbitrary Python source from a caller-supplied URL (or `SOUNDSOCKET_URL` env var), writes it to disk under `/tmp/.soundsocket/`, and executes it in-process via `exec(compile(...))`. This is not an incidental pattern — it is the entire advertised API. The minimal metadata (no description, no repository, no homepage), combined with the fetch-and-exec design targeting a hardcoded example URL `https://example/internal/harness.py`, is consistent with a coordinated loader campaign where the malicious payload is kept off the package index and delivered at runtime. The package itself is a delivery vehicle: any operator can point `url=` at attacker-controlled Python code and have it run inside the victim's process with full interpreter access. The OSV advisory corroborates this as part of a multi-package loader campaign, which the code structure independently confirms. ENTRY soundsocket/__init__.py (module-import: 53) DESTINATION - 1 fetched-payload (urls) (values recorded in verified_iocs) EXFIL - Network Request in soundsocket/__init__.py: "urllib.request.urlopen(" ADDITIONAL FINDINGS - Dynamic Code Execution in soundsocket/__init__.py: "compile(source, mod.__file__, "exec")" PAYLOAD FILES soundsocket/__init__.py