discovered
Backstage LDAP authentication frontend plugin infected by Miasma worm Wave 5. Phantom Gyp binding.gyp trigger with ROT13+eval() obfuscated 4.8 MB index.js. Multiple historical versions infected. Frontend auth component for LDAP directory integration in Backstage.