--- title: Multiple @immobiliarelabs Backstage Plugins Compromised... description: Multiple npm packages maintained by Immobiliare Labs — four Backstage plugins for GitLab integration and LDAP authentication — were found carrying a malicious... canonical: https://daily.dev/posts/multiple-immobiliarelabs-backstage-plugins-compromised-on-npm-mryfkuxnt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Multiple @immobiliarelabs Backstage Plugins Compromised on npm | daily.dev og:description: Multiple npm packages maintained by Immobiliare Labs — four Backstage plugins for GitLab integration and LDAP authentication — were found carrying a malicious... og:url: https://daily.dev/posts/multiple-immobiliarelabs-backstage-plugins-compromised-on-npm-mryfkuxnt og:image: https://api.daily.dev/og/posts/mryfkuXnT.png og:image:alt: Multiple @immobiliarelabs Backstage Plugins Compromised on npm og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Multiple @immobiliarelabs Backstage Plugins Compromised on npm **[StepSecurity](https://daily.dev/sources/stepsecurity)** · 4 min read · 2 upvotes · 0 comments ## Summary Multiple npm packages maintained by Immobiliare Labs — four Backstage plugins for GitLab integration and LDAP authentication — were found carrying a malicious payload on June 26, 2026. Compromised patch versions were published simultaneously across all supported release series within a 30-second window. The attack uses a binding.gyp node-gyp hook to execute a 5 MB obfuscated index.js at install time, bypassing tools that only monitor postinstall scripts. The payload employs three obfuscation layers (ROT-2 cipher, AES-128-GCM, obfuscator.io) and downloads the Bun runtime to evade Node.js security monitoring hooks. It harvests credentials from GitHub Actions, AWS, GCP, Azure, Kubernetes, HashiCorp Vault, package registries, password managers, and SSH keys. A function called infectHost attempts persistence by injecting into AI coding assistant configs including Claude Code, Cursor, GitHub Copilot, VS Code, and Aider. The payload also contains supply chain worm capabilities to republish modified packages using stolen registry tokens. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Miasma Mini Shai-Hulud Hits ImmobiliareLabs npm Packages](https://daily.dev/posts/miasma-mini-shai-hulud-hits-immobiliarelabs-npm-packages-bj8kytenj) · Socket · 0 upvotes · 0 comments - [Node-gyp Supply Chain Compromise](https://daily.dev/posts/node-gyp-supply-chain-compromise-fjrma3w8k) · Snyk · 0 upvotes · 0 comments - [Miasma: Red Hat Cloud Services npm Packages Hit by a Mini Shai-Hulud-Style Campaign](https://daily.dev/posts/miasma-red-hat-cloud-services-npm-packages-hit-by-a-mini-shai-hulud-style-campaign-4kacs0e4h) · Security Boulevard · 0 upvotes · 0 comments - [Mass npm Supply Chain Attack: 20 Leo Platform Packages Compromised](https://daily.dev/posts/mass-npm-supply-chain-attack-20-leo-platform-packages-compromised-01l7qjya4) · StepSecurity · 3 upvotes · 2 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/multiple-immobiliarelabs-backstage-plugins-compromised-on-npm-mryfkuxnt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Multiple @immobiliarelabs Backstage Plugins Compromised on npm","url":"https://daily.dev/posts/multiple-immobiliarelabs-backstage-plugins-compromised-on-npm-mryfkuxnt","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/multiple-immobiliarelabs-backstage-plugins-compromised-on-npm-mryfkuxnt"},"datePublished":"2026-06-26T15:52:51.580Z","dateModified":"2026-06-26T15:53:15.888Z","description":"Multiple npm packages maintained by Immobiliare Labs — four Backstage plugins for GitLab integration and LDAP authentication — were found carrying a malicious...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5b64d53b40194e65e84d3376896ab310?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5b64d53b40194e65e84d3376896ab310?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"StepSecurity","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"StepSecurity","logo":"https://media.daily.dev/image/upload/s--vegWii-S--/f_auto,q_auto/v1774959924/logos/stepsecurity?_a=BAMAMiWQ0","url":"https://daily.dev/sources/stepsecurity"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/multiple-immobiliarelabs-backstage-plugins-compromised-on-npm-mryfkuxnt","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,malware,npm","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"StepSecurity","item":"https://daily.dev/sources/stepsecurity"},{"@type":"ListItem","position":3,"name":"Multiple @immobiliarelabs Backstage Plugins Compromised on npm"}]} ```