GCVE-110-OSM-2026-13978

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-voice-synthesis-profiles Reasons (based on the campaign): - other - Downloads and executes a remote malicious script. Judge assessment: The package implements a remote code loader: on import, `pull()` fetches arbitrary Python source from a caller-supplied URL (or the `TTSWEAVER_URL` environment variable), writes it to disk under `/tmp/.ttsweaver/`, and executes it in-process via `exec(compile(...))`. This is a classic staged-loader pattern — the package itself carries no payload, but any consumer can be directed to execute attacker-controlled code by controlling the URL argument or the environment variable. The IOC URL in the docstring (`https://example/internal/snippet.py`) is a placeholder, but the loader infrastructure is complete and functional. The minimal metadata profile (no description, no repository, no homepage) is consistent with a throwaway campaign package. The OSV advisory corroborates membership in a coordinated 2026 voice-synthesis-profile campaign of similar loader packages. ENTRY ttsweaver/__init__.py (module-import: 53) DESTINATION - 1 fetched-payload (urls) (values recorded in verified_iocs) EXFIL - Network Request in ttsweaver/__init__.py: "urllib.request.urlopen(" ADDITIONAL FINDINGS - Dynamic Code Execution in ttsweaver/__init__.py: "compile(source, mod.__file__, "exec")" PAYLOAD FILES ttsweaver/__init__.py