@doaction/sudo-prompt is a malicious npm package that mimics the name of the legitimate sudo-prompt package but does not provide privilege escalation features. Its installation scripts perform environment telemetry by sending data to Datadog using a caller-provided API key, meaning the telemetry destination is controlled by the user, not an attacker. No credential scraping or remote code fetching was identified. The main risks are confusion due to the package name and undisclosed telemetry during installation. Despite the telemetry nature, some sources consider any system with this package installed as fully compromised, recommending secret rotation and removal.

The package does not steal credentials or execute remote code but performs undisclosed environment telemetry during installation, potentially leaking environment details to Datadog. The name confusion risk may cause developers to install this package instead of the legitimate sudo-prompt, leading to unintended telemetry. Some advisories treat any installation as a full compromise, recommending secret rotation and system remediation. There is no confirmed exploit in the wild.

No official patch or fix is available. The primary mitigation is to remove the @doaction/sudo-prompt package if installed. Rotate all secrets and keys from a separate, trusted environment as a precaution due to the potential full compromise risk. Developers should verify package names carefully to avoid installing similarly named malicious packages. Monitor for and avoid packages that perform undisclosed telemetry or have suspicious install scripts.