tailwind-gutenberg-block-zero — an install-time Windows dropper posing as a Tailwind Gutenberg block
The npm package [email protected] ships the files of a normal WordPress/Gutenberg block plugin (a my-tailwind-blocks.php, wp-scripts build config, a README and a screenshot) — but its package.json carries an install hook that runs node setup.js on every npm install. That script fingerprints the host, downloads a second-stage payload from a hard-coded raw IP, executes it through a hidden PowerShell process, and reports back over the Telegram Bot API. None of this has anything to do with a Tailwind block.
A supply-chain dropper hidden inside a plausible-looking WordPress block package. On the surface it is a Tailwind-styled Gutenberg block (build/, my-tailwind-blocks.php, wp-scripts scripts, readme + screenshot). The malicious behaviour lives entirely in an npm install lifecycle hook — "install": "node setup.js" — so it fires automatically the moment a developer or CI runs npm install, before any of the developer's own code runs.
It is Windows-targeted (it launches PowerShell), multi-stage (it pulls a second payload at install time so the published package stays small and innocuous), and it exfiltrates over Telegram — a pattern shared with other recent npm droppers codelake has documented.
Described from structural analysis of the packed tarball — no working payload or reproduction is published.
1. Trigger. package.json declares scripts.install = "node setup.js". npm runs this on install; the victim never has to import or call anything.
2. Reconnaissance. setup.js reads os.platform() and os.hostname() to fingerprint the host.
3. Second-stage fetch. It requests a hard-coded raw-IP URL — http://172.94.9.157/v028f8cde892b0b74c8.js (an obfuscated-named JS payload) — over Node's https/http and writes it to disk (fs.writeFileSync). Keeping the real payload off-registry is deliberate: it keeps the published package clean and lets the operator swap the payload at will.
4. Execution. It spawns a hidden, minimised PowerShell (child_process.exec("start /min powershell …"), alongside a bundled setup.ps1) to run the downloaded stage out of sight of the user.
5. Exfiltration / C2. Collected data is sent to a Telegram bot via https://api.telegram.org/bot<token>/sendMessage (the assembled URL was reconstructed by our string-deobfuscation pass; the bot token is withheld).
Detected + classified independently by codelake Research via its install-hook behaviour pipeline — deterministic structural analysis of the packed tarball (package.json install hook, raw-IP second-stage fetch, hidden-PowerShell exec, Telegram exfil; the Telegram URL reconstructed by the string-deobfuscation pass). Not present in OSV at time of detection — codelake is the source of record.
This is a confirmed-malware advisory. No working payload or reproduction is published — the behaviour is described from structural analysis, and the C2 endpoint is named as a defensive indicator only. The original artifact is preserved in the codelake archive and available to verified security researchers on request.