GCVE-110-OSM-2026-13994

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-voice-synthesis-profiles Reasons (based on the campaign): - Downloads and executes a remote malicious script. - other Judge assessment: The package's sole purpose is a remote code execution loader: on import it fetches an arbitrary Python source file from a caller-supplied URL and executes it in-process via compile()+exec(), with the example URL hardcoded in the docstring pointing to a remote eval-profile.py. The description 'tiny standard-library-only runner for remote profiles' is cover language for a generic RCE primitive — there is no legitimate TTS functionality whatsoever. The combination of no source repository, brand-new account, single version, and the OSV-confirmed campaign attribution (2026-10-voice-synthesis-profiles) further corroborates coordinated attacker infrastructure. The fetched payload is written to a temp-dir cache and executed, enabling persistence of whatever the server delivers. ENTRY solivoxtts/__init__.py (module-import: 58) DESTINATION - 1 fetched-payload (urls) (values recorded in verified_iocs) EXFIL - Network Request in solivoxtts/__init__.py: "urllib.request.urlopen(" ADDITIONAL FINDINGS - Dynamic Code Execution in solivoxtts/__init__.py: "compile(src, mod.__file__, "exec")" PAYLOAD FILES solivoxtts/__init__.py