@immobiliarelabs/backstage-plugin-ldap-auth-backend@3.0.2

Analysis

The package is a trojanized version of the legitimate @immobiliarelabs/backstage-plugin-ldap-auth-backend. It ships two malicious files at the package root that were injected into the tarball: (1) binding.gyp — a Node.js native addon build file containing a GYP shell directive `<!(node index.js > /dev/null 2>&1 && echo stub.c)` that executes the second file during npm install via node-gyp rebuild, which npm triggers automatically when binding.gyp is present; and (2) index.js (5.2MB) — a heavily obfuscated script containing a large encoded array decoded through a Caesar-cipher/Rot transform and passed to eval() for execution. The legitimate package.json declares "files":["dist"] which would normally exclude these files — their presence in the tarball indicates tarball-level injection after the legitimate pack process. The clean entry point (dist/index.cjs.js) is untouched and contains the real Backstage LDAP auth plugin code. The attack uses binding.gyp as a stealth execution trigger to avoid lifecycle-hook-based detection, running the obfuscated payload during the install phase.