@immobiliarelabs/backstage-plugin-gitlab-backend@3.0.3

Analysis

This version of the package ships two files that are not part of the legitimate plugin and are not declared in the package manifest: a root index.js and a binding.gyp. The binding.gyp abuses node-gyp command substitution (sources:["<!(node index.js > /dev/null 2>&1 && echo stub.c)"]) to silently execute index.js during package installation/build, suppressing all output. index.js is a single eval() over a Caesar-shifted character-code array; once de-obfuscated it is an AES-128-GCM decryptor (createDecipheriv with authTagLength 16) that decrypts a large embedded hex-encoded ciphertext blob and runs the resulting second-stage code. The legitimate plugin code is left intact in dist/ to avoid suspicion, while the injected files run attacker-controlled, encrypted payload at install time. This is a malicious supply-chain injection / install-time dropper.