The @doaction/auth npm package declares a preinstall script that requires a sibling package (@doaction/shared) which transmits environment data to Datadog's API at install time. The telemetry includes authentication-related environment variables but requires a caller-supplied API key for explicit reporting, making the install-time transmission undisclosed and non-optional. The package's lifecycle scripts are confusingly named, reducing review clarity. The telemetry targets a commercial SaaS rather than attacker-controlled infrastructure, indicating the issue is undisclosed telemetry rather than direct credential exfiltration. However, a related advisory from ghsa-malware states that any computer with this package installed should be considered fully compromised, recommending secret rotation and removal. No patch or remediation is currently available.

Installation of this package results in environment data being transmitted to an external commercial telemetry service without user consent, violating privacy and security policies, especially in air-gapped or sensitive environments. According to a related advisory, the presence of this package implies full system compromise, necessitating secret and key rotation. The package may enable unauthorized data exposure and potential further compromise due to undisclosed telemetry behavior.

No official patch or fix is currently available for this package. Users should immediately remove the @doaction/auth package if installed. All secrets and keys on affected systems should be rotated from a separate, trusted environment. Due to the potential full compromise indicated by the advisory, a thorough system investigation and remediation is recommended. Monitor vendor advisories for updates or official remediation guidance.