MalwarePublished 13 Aug 2026

try-lock-runner (npm) · Malicious Code

Affects try-lock-runnerSource GCVE Database

Malicious package : remove try-lock-runner and rotate any secrets on hosts that installed it.

Data as of 14 Aug 2026, 16:44 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-14014

What to do

Remove try-lock-runner from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtry-lock-runner	Affected =3.2.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package try-lock-runner version 3.2.1 contains malicious code or depends on a malicious package. Any system with this package installed should be considered fully compromised, and all secrets and keys stored on that system should be rotated immediately from a different device. Removing the package alone may not eliminate all malicious software resulting from its installation.

Impact

Systems with try-lock-runner version 3.2.1 installed are considered fully compromised, potentially allowing attackers full control over the affected computer. This compromises all secrets and keys stored on the system, necessitating immediate rotation of credentials from a secure environment. The presence of malicious code means that attackers may have persistent access beyond just the package itself.

Defensive guidance

Remove the try-lock-runner package version 3.2.1 immediately. Rotate all secrets and keys stored on the compromised system from a different, secure computer. Because full control of the system may have been given to attackers, consider rebuilding or thoroughly cleaning the affected system to ensure complete removal of malicious software.

Summary

The npm package try-lock-runner version 3.2.1 has been identified as containing malicious code or a dependency with malicious code. According to sources including Amazon Inspector and the GitHub Security Advisory for malware, installation or execution of this package can lead to full compromise of the host system. The advisory warns that secrets and keys stored on the compromised system should be rotated from a separate machine, as removal of the package does not guarantee complete remediation of the infection.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Aug 2026, 16:44 UTC

Technical details

References

Community reviews