Miasma Mini Shai-Hulud Hits ImmobiliareLabs npm Packages

Socket Threat Research reports a supply-chain compromise of @immobiliarelabs Backstage plugins published on June 26, 2026 as part of the Miasma Mini Shai‑Hulud campaign. Malicious root-level index.js loaders, a shared binding.gyp republish trick, Bun-executed multi-stage payloads, and compromised GitHub Actions were used to steal environment and CI/CD secrets, create exfiltration repositories, and propagate further; the report lists affected package versions, SHA‑256 hashes, and remediation guidance.