The renovate-config-doctolib npm package includes a malicious preinstall script that reads the .npmrc configuration file to exfiltrate sensitive data to a remote server. This behavior constitutes a supply chain attack via a malicious package. The package has few published versions, and any system with this package installed or running is considered fully compromised. The threat advisory recommends immediate rotation of all secrets and keys from a separate, uncompromised system and removal of the package, though full remediation may require additional measures due to potential persistent malicious software.

Systems with the renovate-config-doctolib package installed are fully compromised, risking exposure of all stored secrets and keys. Attackers may have gained persistent access, and sensitive configuration data is exfiltrated to an external server. This can lead to further unauthorized access and data breaches.

Remove the renovate-config-doctolib package immediately. Rotate all secrets and keys stored on the compromised system from a different, secure computer. Because full control may have been given to an attacker, additional forensic analysis and remediation steps beyond package removal are recommended to ensure complete eradication of malicious software.