setup.py downloads and launches a Python file
The README tells you to clone the repository and run python setup.py. Reading that file changes the decision. Before ordinary packaging logic appears, it imports src.report and calls report.run_sync(). That module is a large block of encoded byte arrays, XOR operations, dynamic imports, decryption, decompression, and an exec call. This is executable behavior hidden behind names such as _p92hk3 and _cmmv3p, not normal metadata for a tax calculator.
The same setup.py constructs an HTTPS prefix from character codes, obtains a URL and decoder from names supplied at runtime, downloads a response, writes decoded bytes to src/dex.py, and starts that file with subprocess.Popen. We did not execute or decode this path outside the supplied sandbox run. You should not either. Thirty-five clean packages in pip-audit do not assess code embedded in the repository or a payload fetched while setup runs.
The 84-file checkout still has an unsafe setup path
On paper, the project covers the tedious parts of crypto accounting. The README describes adapters for exchanges, blockchain explorers, hardware wallets, desktop wallets, and CSV exports. Its unified import engine is supposed to classify trades, transfers, staking income, airdrops, mining rewards, gifts, and fees before producing PDF or CSV reports. The checkout at commit 2a0e8fc contained 84 files and about 13,424 lines of source, so there is real application code here.
The configuration file exposes base currency, timezone, date order, price providers, fee treatment, transfers, and lost-token handling. Those switches also show why tax software needs narrow jurisdiction claims. The README gives categorical treatments for airdrops, gifts, charity, fees, and losses, yet it does not name supported tax forms, country modules, filing-year rules, or an external review of those decisions. A London timezone default is not a compliance model.
What happened when we ran it
Our fresh Debian sandbox installed commit 2a0e8fc in 24 seconds. The environment used 3 CPUs, 8 GB of RAM, Python 3.12, no secrets, and no elevated privileges. Installation added 35 packages and occupied 37 MB. Pip-audit found 0 known vulnerabilities in those installed dependencies. That result says nothing about the obfuscated repository code or any file it may retrieve.
The build failed after 4 seconds with exit code 1. The measurement summary provided for this review does not include the log tail, so we cannot name the failing command, exception, or missing requirement. Calling it a system-package problem would be speculation. There was no test script or target for the lab runner, so tests were skipped rather than passed or failed.
The repository had 1 CI workflow, no Dockerfile, and no top-level tests directory in our measured snapshot. Some files under src/tests are visible in the tree, but the lab found no supported test target to invoke. That distinction matters: test-looking files do not give a user a repeatable verification command, and they did not produce a result in our run.
The README names no validated tax jurisdiction
The README claims support for multiple tax jurisdictions but identifies 0 validated country forms or filing-year rule sets. One example says a task-based airdrop is income while a freely received one is not. Other sections assign treatments to gifts, charity, transfer fees, and lost assets. A competent developer should ask where those rules are encoded and what report a tax professional can reconcile. The documentation does not answer those questions.
The price path adds another verification burden. The default config names 2 fiat sources and 2 crypto sources, but the README does not explain credential requirements, rate selection when providers disagree, cache behavior, or the evidence stored beside a calculated value. Historical price provenance is part of an audit trail. A final PDF without reproducible inputs is only a formatted assertion.
Three open pull requests do not address the setup risk
GitHub showed 379 stars, 3 open issues and pull requests, and a last push on October 3, 2026. The API returned all 3 open items as pull requests, including 2 typo fixes and an unrelated tariff-service suggestion. There was no latest release in GitHub's releases endpoint. Recent activity therefore exists, but the visible discussion does not address the setup behavior or establish release discipline.
AGPL-3.0 licensing would normally make the calculation path inspectable. Here, inspection is exactly what stops the recommendation. A tax tool handles transaction histories, wallet identifiers, and documents that deserve a tighter trust boundary than ordinary developer utilities. Use Rotki, BittyTax, or RP2 after doing your own jurisdiction check. Leave this repository isolated until its maintainers remove the obfuscated execution path and publish a reproducible, passing verification route.