The 'root-locator' npm package versions 1.1.0 and 1.2.0 have been identified as containing malicious code or dependencies with malicious code. According to sources including Amazon Inspector and the GitHub Security Advisory for malware, any system with this package installed or running should be considered fully compromised. The malicious code can grant an attacker full control over the affected system, posing a severe security risk. Immediate remediation involves removing the package and rotating all secrets and keys from a secure environment, though full eradication of the compromise cannot be guaranteed by removal alone.

Systems with 'root-locator' versions 1.1.0 or 1.2.0 installed or running are at risk of full compromise. Attackers may gain complete control over the affected computer, potentially accessing or exfiltrating sensitive data, including secrets and keys. This compromises the confidentiality, integrity, and availability of the system and its data.

Remove the 'root-locator' package versions 1.1.0 and 1.2.0 immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or used on the compromised systems, performing this rotation from a separate, secure machine. Due to the potential for persistent malicious software beyond the package itself, consider conducting a full system forensic analysis and remediation. No official patch or fix is indicated; the package should be considered untrusted and avoided.