{
  "schema_version": "1.6.0",
  "id": "CLR-2026-3037",
  "modified": "2026-07-17T00:00:00Z",
  "published": "2026-07-17T00:00:00Z",
  "summary": "tailwind-gutenberg-block-zero — an install-time Windows dropper posing as a Tailwind Gutenberg block",
  "details": "The npm package tailwind-gutenberg-block-zero@1.0.0 ships the files of a normal WordPress/Gutenberg block plugin (a my-tailwind-blocks.php, wp-scripts build config, a README and a screenshot) — but its package.json carries an install hook that runs node setup.js on every npm install. That script fingerprints the host, downloads a second-stage payload from a hard-coded raw IP, executes it through a hidden PowerShell process, and reports back over the Telegram Bot API. None of this has anything to do with a Tailwind block.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "tailwind-gutenberg-block-zero"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://research.codelake.dev/advisories/clr-2026-3037-tailwind-gutenberg-block-zero"
    }
  ],
  "credits": [
    {
      "name": "Sascha Klein, codelake Research",
      "type": "FINDER",
      "contact": [
        "https://research.codelake.dev"
      ]
    }
  ],
  "database_specific": {
    "caseId": "CLR-2026-3037",
    "kind": "malware",
    "class": "Install-time multi-stage dropper (Windows; download-execute)",
    "severity": "Critical",
    "status": "Confirmed malicious",
    "iocs": {
      "ips": [
        "172.94.9.157"
      ],
      "hashes": [
        "sha256:335ec20a718179b3ec6e79a97fdea9c6498bf024018989e0bf4109bff4e827e1"
      ],
      "indicators": [
        "172.94.9.157 — hard-coded raw-IP C2 / second-stage host (routable; defensive indicator)",
        "http://172.94.9.157/v028f8cde892b0b74c8.js — second-stage payload",
        "api.telegram.org/bot/sendMessage — Telegram Bot API exfil channel",
        "setup.js + setup.ps1 (install-hook dropper) · package.json scripts.install = \"node setup.js\"",
        "335ec20a718179b3ec6e79a97fdea9c6498bf024018989e0bf4109bff4e827e1 (tailwind-gutenberg-block-zero@1.0.0)"
      ]
    }
  }
}