@immobiliarelabs/backstage-plugin-ldap-auth-backend@1.1.3

Analysis

This package ships an index.js that is a fully obfuscated multi-stage dropper rather than the Backstage LDAP auth plugin it claims to be. The entire file is a single eval() over a Caesar-shifted character-code array; decoding it reveals an async bootstrap that loads node:crypto and builds an AES-128-GCM decryptor. The first decrypted stage is a loader that, based on the host OS and CPU architecture, creates a temp directory and shells out to curl to download the standalone Bun JavaScript runtime (bun-v1.3.13) from GitHub releases, unzips it, and marks it executable. A second, much larger AES-128-GCM-encrypted blob is embedded in the same file and is decrypted to be run via that downloaded Bun runtime. Fetching an alternate JS runtime at execution time and decrypting a hidden payload to run through it is dropper behaviour with no legitimate purpose in an authentication plugin.