# MAL-2026-6529: Malicious code in @immobiliarelabs/backstage-plugin-ldap-auth-backend (npm)


- **Type:** Malicious package
- **Package:** `@immobiliarelabs/backstage-plugin-ldap-auth-backend` (npm)
- **Published:** 26 Jun 2026

## What is MAL-2026-6529?

MAL-2026-6529 is a malicious package in @immobiliarelabs/backstage-plugin-ldap-auth-backend, published on 26 Jun 2026. 

### Official description

The package ships a binding.gyp at the package root containing GYP command-expansion syntax (`<!(...)`) in its sources/targets configuration (binding.gyp line 6). npm implicitly runs `node-gyp rebuild` whenever a binding.gyp is present — even with no declared install/postinstall script — and node-gyp evaluates `<!(...)` as a shell command during the configure step. This causes the embedded command to execute on the installing developer's or build system's machine on a default `npm install`, functionally equivalent to a malicious lifecycle hook. The package presents itself as a Backstage LDAP auth backend plugin, which has no legitimate need for a native build step or shell expansion in its build configuration. Stage-1 contextual tracing of the package contents was withheld by the model provider's safety filter, which engages specifically on content that reads as operational malware — a corroborating signal alongside the binding.gyp command-expansion finding.

## What should I do about MAL-2026-6529?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-6529 is a malicious package: @immobiliarelabs/backstage-plugin-ldap-auth-backend (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-6529/ (Markdown: https://insights.sbomify.com/MAL-2026-6529/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-6529

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-6529/
Summaries are generated and may contain mistakes; the official description above is the record.