@immobiliarelabs/backstage-plugin-gitlab-backend@4.0.2

Analysis

@immobiliarelabs/backstage-plugin-gitlab-backend@4.0.2 is a trojanized clone of the legitimate Backstage GitLab plugin. The package ships a clean plugin entry point in dist/index.cjs.js and a hidden malicious payload in package/index.js — a 5.3 MB file containing a ROT13-cipher-obfuscated eval payload. At install time, package/binding.gyp executes node index.js via the GYP <!() shell-command syntax (node-gyp rebuild), suppressing all output with >/dev/null 2>&1. The payload file and binding.gyp are excluded from the package.json "files" allowlist, confirming they were injected into the tarball after the legitimate build step.