GCVE-110-OSM-2026-13979

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-voice-synthesis-profiles Reasons (based on the campaign): - other - Downloads and executes a remote malicious script. Judge assessment: This package implements a remote code loader: on import or explicit call, `retrieve()` fetches an arbitrary Python source file from a caller-supplied URL (or the `VOCABBENCH_URL` environment variable), writes it to a temp directory, and executes it in-process via `exec(compile(...))`. The hardcoded example URL in the docstring and IOC list points to an internal endpoint pattern consistent with a loader campaign. The package has no real functionality of its own — it is pure loader plumbing, with minimal metadata, no repository, and no description, fitting the 'coordinated campaign' shape. The attacker model is a supply-chain loader: victim installs the package, calls `start()` with a URL (or sets the env var), and the remote payload executes with full process privileges. The OSV advisory's characterization of a coordinated campaign of similar loader packages is consistent with what the code actually does. ENTRY vocabbench/__init__.py (module-import: 53) DESTINATION - 1 fetched-payload (urls) (values recorded in verified_iocs) EXFIL - Network Request in vocabbench/__init__.py: "urllib.request.urlopen(" ADDITIONAL FINDINGS - Dynamic Code Execution in vocabbench/__init__.py: "compile(source, mod.__file__, "exec")" PAYLOAD FILES vocabbench/__init__.py