trgrip@1.0.4

Analysis

Package trgrip@1.0.4 combosquats the legitimate is-sorted module and runs a malicious postinstall hook on installation. The hook fetches a remote shell script from reunionistic-keagan-unfestively[.]ngrok-free[.]dev/rev.sh and executes it via bash in a detached background process (exec with detached:true) that persists beyond the npm install lifecycle. The ngrok tunnel URL serves as a dynamic command-and-control endpoint for the second-stage payload.