GCVE-110-OSM-2026-13985

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-voice-synthesis-profiles Reasons (based on the campaign): - Downloads and executes a remote malicious script. - other Judge assessment: This package is a remote code loader that fetches an arbitrary Python script from a caller-supplied URL and executes it in-process via exec(compile(...)). The `retrieve()` function downloads raw bytes from any URL (falling back to the ACOUSTICPACK_URL environment variable), writes the payload to disk under /tmp/.acousticpack/, and exec's it into a live module — a textbook fetch-and-execute pattern. The hardcoded example URL in the docstring and IOCs points to the loader infrastructure. The package was published under a plausible-sounding name ('profile-based evaluation plumbing for CPU benchmarks') to disguise what is purely a remote-payload executor. Combined with brand-new publisher, no repository, single version, and the OSV advisory confirming coordinated campaign '2026-10-voice-synthesis-profiles', this is a confirmed malicious loader with no legitimate use case that requires this architecture. ENTRY acousticpack/__init__.py (module-import: 53) DESTINATION - 1 fetched-payload (urls) (values recorded in verified_iocs) EXFIL - Network Request in acousticpack/__init__.py: "urllib.request.urlopen(" ADDITIONAL FINDINGS - Dynamic Code Execution in acousticpack/__init__.py: "compile(source, mod.__file__, "exec")" - Brand New Package PAYLOAD FILES acousticpack/__init__.py