crypto-tax-export

Details

**Severity:** Critical

**Affected versions:** `= 0.9.1`

## Source: amazon-inspector (d2481974cbcc361b29455129afea878124dafde18097efca0a87235df57f3bea)
The gem's native-extension build script ext/crypto_tax_export/extconf.rb runs during `gem install`. Before executing its payload it performs sandbox/analysis-evasion checks (CI environment variables, ephemeral/generated hostnames and usernames, known analysis paths, system uptime under 30 minutes, and presence of developer-signal files such as ~/.ssh, ~/.gem/credentials, and ~/.gitconfig). When those checks indicate a real developer workstation, it double-forks a detached, stdio-closed daemon that sleeps a randomized 20-40 minutes and then executes `eval(Base64.decode64(...))` on an embedded payload that opens a /bin/sh reverse shell via TCPSocket to the hardcoded bare IP 45.138.12.177:8089 in a reconnect loop. The create_makefile call is a stub targeting an unrelated name (`bitcoin_rpc_lite_native`), the shipped lib/crypto_tax_export.rb contains only trivial VERSION/build_id/healthy? methods with no tax-export functionality, and the README is for a different package (`bitcoin-rpc-lite`), indicating the extension script is the gem's sole purpose and the advertised identity is cover.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ff41f6680a0ebbef2268cdb5daf253d4b400cb05/osv/malicious/rubygems/crypto-tax-export/MAL-2026-17782.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ff41f6680a0ebbef2268cdb5daf253d4b400cb05/osv/malicious/rubygems/crypto-tax-export/MAL-2026-17782.json
- https://rubygems.org/gems/crypto-tax-export/versions/0.9.1
- https://github.com/advisories/GHSA-7qmm-9mrq-vf4q

Compromised versions (1)

• = 0.9.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.