GCVE-110-OSM-2026-13983

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-voice-synthesis-profiles Reasons (based on the campaign): - Downloads and executes a remote malicious script. - other Judge assessment: The package implements a remote code execution loader: on import or explicit call, `fetch()` downloads arbitrary Python source from a caller-supplied URL (or `PIPEGRIP_URL` env var), writes it to a temp directory, and `exec(compile(...))` executes it in a fresh module namespace. The example URL embedded in the docstring and flagged as a C2 IOC demonstrates the intended delivery pattern. The minimal metadata (no description, no repo, no homepage) and the absence of any legitimate utility beyond 'load and run remote code' are consistent with a coordinated campaign of disposable loader packages. The advisory-corroborated campaign places this alongside similar packages designed to deliver a remote payload whose content is controlled entirely by the operator at the time of use, making the absence of an embedded payload irrelevant to the malicious classification. ENTRY pipegrip/__init__.py (module-import: 53) DESTINATION - 1 fetched-payload (urls) (values recorded in verified_iocs) EXFIL - Network Request in pipegrip/__init__.py: "urllib.request.urlopen(" ADDITIONAL FINDINGS - Dynamic Code Execution in pipegrip/__init__.py: "compile(source, mod.__file__, "exec")" PAYLOAD FILES pipegrip/__init__.py