MalwarePublished 26 Jun 2026Updated 28 Jul 2026

@immobiliarelabs/backstage-plugin-gitlab (npm) · Malicious Code

Affects @immobiliarelabs/backstage-plugin-gitlabSource GCVE Database

Malicious package : remove @immobiliarelabs/backstage-plugin-gitlab and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:55 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6526

What to do

Remove @immobiliarelabs/backstage-plugin-gitlab from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@immobiliarelabs/backstage-plugin-gitlab	Affected 1.0.1 – 7.0.2 7 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @immobiliarelabs/backstage-plugin-gitlab contains malicious code embedded in a binding.gyp file. This file uses GYP command-expansion syntax to execute shell commands during the npm install process, despite the package being a frontend plugin with no legitimate need for native addons. The executed code is considered operational malware. Multiple specific versions of the package are affected. No official patch or remediation guidance is currently provided.

Impact

Any user installing affected versions of the @immobiliarelabs/backstage-plugin-gitlab package will have arbitrary shell commands executed on their system during npm install. This can lead to compromise of the development or build environment, potential data theft, unauthorized access, or further malware deployment. The threat is embedded in the install process and does not require explicit execution by the user beyond installing the package.

Defensive guidance

Users should avoid installing the affected versions of @immobiliarelabs/backstage-plugin-gitlab listed. Review dependency trees for transitive inclusion of these versions and remove or replace them. Monitor vendor advisories or trusted security sources for updates or official fixes. Since this is a malicious package inclusion, consider additional supply chain security measures such as verifying package integrity and using trusted registries.

Summary

The @immobiliarelabs/backstage-plugin-gitlab npm package includes a binding.gyp file at its root that contains GYP command-expansion syntax (<!(...)) in the targets/sources fields. npm automatically runs node-gyp rebuild when binding.gyp is present, causing the embedded shell command to execute during installation. Since the package is a pure TypeScript/React frontend plugin with no C/C++ source files, the binding.gyp file serves solely to run malicious shell commands at install time. The exact malicious payload was withheld due to malware safety filtering, confirming the presence of operational malware rather than benign build logic. This affects multiple exact versions of the package, indicating a supply chain compromise or intentional malicious inclusion.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Jun 2026, 22:20 UTC

Technical details

References

Community reviews