The npm package renovate-config-doctolib contains malicious code that exfiltrates data by reading the .npmrc file during its preinstall script and sending this data to a remote server. Installation of this package can lead to full system compromise, and all secrets and keys on the affected system should be rotated immediately. Removal of the package alone may not fully remediate the compromise due to potential additional malicious software installed.