[Under Evaluation]: Multiple versions of several @immobiliarelabs Backstage plugins appear to be affected by a potential supply-chain compromise.

Current observed packages:

– backstage-plugin-gitlab: 1.0.1, 2.1.2, 3.0.3, 4.0.2, 5.2.1, 6.13.1, 7.0.2

– backstage-plugin-gitlab-backend: 3.0.3, 4.0.2, 5.2.1, 6.13.1, 7.0.2

– backstage-plugin-ldap-auth: 1.1.4, 2.0.5, 3.0.2, 4.3.2, 5.2.1

– backstage-plugin-ldap-auth-backend: 1.1.3, 2.0.5, 3.0.2, 4.3.2, 5.2.1

Analysis identified suspicious install-time execution via a newly introduced binding.gyp, which executes a large bundled index.js during the node-gyp build process – a pattern consistent with recent npm supply-chain attacks.

Recommendation: Remove the affected package versions immediately, investigate recent installations, review lockfiles and SBOMs, audit CI/CD pipelines for recent upgrades, and block the affected releases in package registries while the investigation is