renovate-config-doctolib@9.9.16

Analysis

Version-squatting package impersonating renovate-config-doctolib (a Renovate shared config). Its preinstall hook (scripts/audit.js) reads ~/.npmrc to extract registry URLs and tokens, collects the installer's hostname, username, platform, git remote URLs, and Windows AD domain environment variables. All stolen data is base64-encoded into a single query string and sent via HTTPS GET to baoreqygjveumkkxydcd[.]supabase[.]co/functions/v1/Webhook_OOB, a Supabase Edge Function acting as the C2 collector. The C2 hostname is obfuscated via base64 decoding at runtime to bypass static analysis. The package exfiltrates its installer's npm registry credentials, git metadata, and host identity — enabling downstream token theft, package hijacking, and lateral movement into the victim's CI/CD supply chain.