discovered
Backstage GitLab SCM backend plugin infected by Miasma worm Wave 5. Phantom Gyp binding.gyp trigger with ROT13+eval() obfuscated 4.8 MB index.js. Multiple historical versions infected. Used in enterprise CI/CD pipelines integrating Backstage with GitLab — compromise exposes GitLab tokens and CI/CD environment credentials.