The npm package async-lock-queue version 3.0.1 has been identified as containing malicious code or relying on a malicious dependency. According to sources including Amazon Inspector and the GitHub Security Advisory for malware, any system with this package installed or running should be considered fully compromised. The malicious code potentially grants full control to an outside entity, posing a severe security risk. Immediate secret and key rotation is advised from a separate, uncompromised system. Due to the nature of the compromise, simply uninstalling the package does not guarantee removal of all malicious artifacts.

Systems with async-lock-queue version 3.0.1 installed or running are at risk of full compromise, including unauthorized access and control by attackers. Sensitive information such as secrets and keys stored on the system may be exposed and should be rotated. The presence of this package can lead to persistent malicious activity beyond the package itself.

Remove the async-lock-queue package version 3.0.1 immediately. Rotate all secrets and keys stored on the compromised system from a separate, secure machine. Because the system may be fully compromised, consider a full system rebuild or forensic analysis to ensure removal of all malicious components. Monitor for any suspicious activity related to this compromise.