GCVE-110-OSM-2026-13990

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-voice-synthesis-profiles Reasons (based on the campaign): - Downloads and executes a remote malicious script. - other Judge assessment: The package's sole function is to fetch a remote Python script from a caller-supplied URL and execute it in-process via `exec(compile(src, ...))`. The example in the docstring hardcodes `https://example/serve/eval-profile.py` as the profile URL, framing this as a legitimate TTS loader, but the actual mechanism is a generic remote-code-execution loader: `_fetch()` downloads arbitrary Python, `load()` compiles and executes it with full access to the interpreter, and `run()` calls its `run()` entry point with arbitrary kwargs. There is no validation, sandboxing, or integrity check on the fetched payload. The package is newly published (single version, no repository, no dependents), and the description 'Tiny standard-library loader for remote voice-synthesis profiles' is a social-engineering cover for what is functionally a staged loader — the actual malicious payload lives server-side behind the profile URL. The OSV advisory corroborates this as part of a coordinated campaign of deceptive loader packages. ENTRY phonoviatts/__init__.py (module-import: 58) DESTINATION - 1 fetched-payload (urls) (values recorded in verified_iocs) EXFIL - Network Request in phonoviatts/__init__.py: "urllib.request.urlopen(" ADDITIONAL FINDINGS - Dynamic Code Execution in phonoviatts/__init__.py: "compile(src, mod.__file__, "exec")" PAYLOAD FILES phonoviatts/__init__.py