The @immobiliarelabs/backstage-plugin-gitlab npm package includes a binding.gyp file at its root that contains GYP command-expansion syntax (<!(...)) in the targets/sources fields. npm automatically runs node-gyp rebuild when binding.gyp is present, causing the embedded shell command to execute during installation. Since the package is a pure TypeScript/React frontend plugin with no C/C++ source files, the binding.gyp file serves solely to run malicious shell commands at install time. The exact malicious payload was withheld due to malware safety filtering, confirming the presence of operational malware rather than benign build logic. This affects multiple exact versions of the package, indicating a supply chain compromise or intentional malicious inclusion.

Any user installing affected versions of the @immobiliarelabs/backstage-plugin-gitlab package will have arbitrary shell commands executed on their system during npm install. This can lead to compromise of the development or build environment, potential data theft, unauthorized access, or further malware deployment. The threat is embedded in the install process and does not require explicit execution by the user beyond installing the package.

No official patch or remediation is currently documented. Users should avoid installing the affected versions of @immobiliarelabs/backstage-plugin-gitlab listed. Review dependency trees for transitive inclusion of these versions and remove or replace them. Monitor vendor advisories or trusted security sources for updates or official fixes. Since this is a malicious package inclusion, consider additional supply chain security measures such as verifying package integrity and using trusted registries.