@immobiliarelabs/backstage-plugin-gitlab@2.1.2

Analysis

A compromised release of this Backstage GitLab plugin ships two files that are not part of the genuine package: a root-level binding.gyp and an index.js dropper. The genuine package is a pure React/TypeScript frontend plugin and publishes only its dist/ output. The injected binding.gyp uses GYP command-expansion syntax ("<!(node index.js ...)") in its sources field; because npm automatically runs node-gyp whenever a binding.gyp exists at the package root, this causes `node index.js` to execute on every install of the package — with no install or postinstall script declared, and regardless of the package main entry. index.js is a layered, obfuscated dropper: an outer eval() runs a Caesar-cipher-decoded wrapper that imports node:crypto, AES-128-GCM-decrypts an embedded encrypted blob, and eval()s the decrypted second-stage code. The use of a native-build manifest to trigger silent install-time execution in a frontend-only plugin, combined with multi-layer (Caesar + AES-GCM) self-decrypting eval, is characteristic of a supply-chain attack rather than legitimate functionality.