The @immobiliarelabs/backstage-plugin-ldap-auth npm package includes a binding.gyp file at the tarball root that uses GYP command-expansion syntax (<!(...) / <!@(...)) in its sources/targets configuration. npm triggers node-gyp rebuild automatically when binding.gyp is present, causing node-gyp to execute shell commands embedded in the binding.gyp during the configure step. This results in arbitrary code execution on the installer's machine at install time, equivalent to a postinstall lifecycle hook. The package falsely presents as a pure JavaScript LDAP auth plugin for Backstage, for which a native addon is unnecessary, indicating malicious intent. The affected versions explicitly include 1.1.4, 2.0.5, 3.0.2, 4.3.2, and 5.2.1.

An attacker can achieve arbitrary code execution on the system of any user who installs the affected package versions. This occurs during the npm install process before any application code runs, allowing execution of shell commands with the privileges of the installing user. This can lead to system compromise, data theft, or further malware installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fixed version is available, avoid installing or updating to the affected versions of @immobiliarelabs/backstage-plugin-ldap-auth. Consider auditing your dependency tree for this package and removing or replacing it if found. Monitor official sources for updates or patches addressing this malicious package.