Malicious code in @immobiliarelabs npm packages (Miasma Mini Shai-Hulud supply-chain attack). Twenty-two @immobiliarelabs-scoped packages (backstage-plugin-gitlab, backstage-plugin-gitlab-backend, backstage-plugin-ldap-auth, backstage-plugin-ldap-auth-backend) were compromised. The malware uses a "Phantom Gyp" binding.gyp trick to execute a hidden payload at install time, applying Caesar-shift encoding and AES-128-GCM decryption to conceal its logic. On execution it harvests developer and CI/CD secrets — .env files and npm/PyPI/GitHub/Slack/Twilio/AWS/Azure/GCP tokens — and abuses GitHub Actions workflows to self-propagate. Any environment that installed an affected version should treat all reachable credentials as compromised and rotate them.