The npm package @immobiliarelabs/backstage-plugin-gitlab-backend contains malicious code embedded in its binding.gyp file. This file uses GYP command-expansion syntax to execute shell commands automatically during npm install via node-gyp rebuild, without any explicit install or postinstall scripts. The package masquerades as a Backstage backend plugin but includes a native-addon build descriptor solely to trigger remote code execution on the installer's machine. Multiple specific versions are affected, and the malicious behavior occurs automatically on default installation.