GCVE-110-OSM-2026-13982

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-voice-synthesis-profiles Reasons (based on the campaign): - other - Downloads and executes a remote malicious script. Judge assessment: The package implements a fetch-and-execute loader: on import, `acquire()` downloads arbitrary Python source from a caller-supplied URL (defaulting to the `VOXWEAVER_URL` environment variable), writes it to a temp directory, and `exec(compile(...))` it in-process with full interpreter access. The example in the module docstring and the IOC classification both point to `https://example/internal/harness.py` as the intended fetch target, but any URL can be substituted at call time, making this a generic remote-code-execution primitive. The package was published within the last 2 hours with no repository, no prior versions, and no dependents — classic disposable loader tradecraft. The OSV advisory corroborates this as part of a coordinated multi-package campaign (2026-10-voice-synthesis-profiles) deploying similar loaders. The only ambiguity is that the fetched payload is not bundled in the package itself, so the ultimate malicious action depends on what URL is passed; nonetheless, a package whose sole purpose is `fetch URL → exec in-process` with no safety controls is unambiguously a loader/dropper. ENTRY voxweaver/__init__.py (module-import: 53) DESTINATION - 1 fetched-payload (urls) (values recorded in verified_iocs) EXFIL - Network Request in voxweaver/__init__.py: "urllib.request.urlopen(" ADDITIONAL FINDINGS - Dynamic Code Execution in voxweaver/__init__.py: "compile(source, mod.__file__, "exec")" - Brand New Package PAYLOAD FILES voxweaver/__init__.py