my-tailwind-gutenberg-block@0.1.2

Analysis

my-tailwind-gutenberg-block@0.1.2 is a trojanized clone of a WordPress block development example. The package.json install hook runs setup.js, which on Windows installs the Deno runtime and then executes a remote payload fetched from hxxp://172[.]94[.]9[.]157/v028f8cde892b0b74c8[.]js with full system permissions. The payload sets up autorun persistence. The C2 host is 172[.]94[.]9[.]157.