Immobiliarelabs NPM packages have been compromised
The Immobiliarelabs NPM packages have been compromised, as reported in a GitHub issue for the backstage-plugin-gitlab repository. The issue details that the NPM packages published under the Immobiliarelabs scope were tampered with, posing a security risk to users who installed them.
Background
- **Immobiliare Labs** is the open-source division of Immobiliare.it, an Italian real-estate company. They maintain popular Backstage plugins for GitLab integration.
- **Backstage** is an open-source developer portal platform (originally built by Spotify) used by companies to centralize infrastructure and developer tools.
- **NPM packages** are code libraries published to the npm registry (the standard package manager for JavaScript/Node.js). "Compromised" means an attacker gained control of the publishing credentials and pushed malicious code disguised as legitimate updates.
- This is a **supply-chain attack**: anyone who installed or updated one of the compromised Immobiliare NPM packages (e.g., `backstage-plugin-gitlab`) in their Backstage instance may have introduced malicious code into their environment.
- The GitHub issue #1052 (linked) is where the maintainers publicly confirmed the breach, and likely where technical details and remediation steps (checking lockfiles, rotating secrets, revoking tokens) are being discussed.