malware
npm
@immobiliarelabs/backstage-plugin-gitlab
discovered 2026-06-26Backstage GitLab frontend plugin infected by Miasma worm Wave 5. Phantom Gyp binding.gyp trigger with ROT13+eval() obfuscated 4.8 MB index.js. Multiple historical versions infected. Frontend component for GitLab SCM integration in Backstage.
Threat types
worm credential_stealer data_exfiltration
Malicious versions
- 1.0.1
- 2.1.2
- 3.0.3
- 4.0.2
