MAL-2026-17782 Malicious code in crypto-tax-export (RubyGems)

The gem's native-extension build script ext/crypto_tax_export/extconf.rb runs during gem install. Before executing its payload it performs sandbox/analysis-evasion checks (CI environment variables, ephemeral/generated hostnames and usernames, known analysis paths, system uptime under 30 minutes, and presence of developer-signal files such as ~/.ssh, ~/.gem/credentials, and ~/.gitconfig). When those checks indicate a real developer workstation, it double-forks a detached, stdio-closed daemon that sleeps a randomized 20-40 minutes and then executes eval(Base64.decode64(...)) on an embedded payload that opens a /bin/sh reverse shell via TCPSocket to the hardcoded bare IP 45.138.12.177:8089 in a reconnect loop. The create_makefile call is a stub targeting an unrelated name (bitcoin_rpc_lite_native), the shipped lib/crypto_tax_export.rb contains only trivial VERSION/build_id/healthy? methods with no tax-export functionality, and the README is for a different package (bitcoin-rpc-lite), indicating the extension script is the gem's sole purpose and the advertised identity is cover.