discovered
Backstage LDAP authentication backend plugin infected by Miasma worm Wave 5. Phantom Gyp binding.gyp trigger with ROT13+eval() obfuscated 4.8 MB index.js. Multiple historical versions infected. Handles enterprise LDAP/Active Directory authentication in Backstage — compromise exposes LDAP credentials and directory service access.