Malicious code in crypto-tax-export (RubyGems)

The 'crypto-tax-export' RubyGem version 0.9.1 includes a native-extension build script (ext/crypto_tax_export/extconf.rb) that executes during 'gem install'. This script performs multiple sandbox and analysis evasion checks such as detecting CI environment variables, ephemeral hostnames and usernames, known analysis paths, short system uptime, and presence of developer-specific files. If these checks indicate a real developer environment, the script double-forks a detached daemon that sleeps for a randomized 20-40 minutes before executing a Base64-decoded payload. This payload opens a reverse shell via /bin/sh to a hardcoded IP address (45.138.12.177) on port 8089, attempting to maintain persistence via a reconnect loop. The rest of the gem's code is trivial and unrelated to its advertised functionality, indicating the gem is a malicious package masquerading as a legitimate tax export tool.

If installed, the gem can provide an attacker with remote shell access to the affected system, potentially allowing unauthorized control and further compromise. The delayed execution and sandbox evasion techniques increase the likelihood of bypassing automated detection and analysis. The malicious code targets developer workstations, which may have sensitive credentials or access to critical infrastructure.

No official patch or remediation is currently documented. Users should avoid installing the 'crypto-tax-export' gem version 0.9.1. Remove any installations of this gem immediately. Monitor systems for unusual outbound connections to the IP 45.138.12.177 on port 8089. Employ network-level blocking of this IP and port if possible. Use trusted sources for RubyGems and verify package integrity before installation.