Malicious crypto-tax-export gem opens a reverse shell during installation while posing as a Bitcoin RPC library
A package named crypto-tax-export has been published on RubyGems, with a native extension build script that executes during gem installation itself. Before running its payload, it checks that this is a real developer workstation rather than a sandbox (CI variables, temporary hostnames and usernames, analysis paths, low uptime, the presence of SSH keys, RubyGems credentials and git configuration), then forks a background process, waits a random number of tens of minutes and uses eval on a base64 payload to open a shell to a hardcoded external host in a reconnection loop. The gem has none of the advertised tax export functionality: the README and native target name were copied from an unrelated Bitcoin RPC package, so the cover story is aimed at Bitcoin developers. The result is full interactive access to a machine holding SSH keys, package publishing tokens and wallet source code.
Immediately check whether this gem was installed in projects, build images or workstations; if you find a match, consider the host compromised: disconnect it from the network rather than merely removing the package, rotate SSH keys, package publishing credentials and other secrets from this machine, check outbound connection logs for long TCP sessions to unknown addresses, and redeploy the environment from scratch. Replace any private keys and seeds that may have been stored or entered on such a machine, and transfer funds from a device you trust.
Source: github.com