The npm package try-lock-runner version 3.2.1 has been identified as containing malicious code or a dependency with malicious code. According to sources including Amazon Inspector and the GitHub Security Advisory for malware, installation or execution of this package can lead to full compromise of the host system. The advisory warns that secrets and keys stored on the compromised system should be rotated from a separate machine, as removal of the package does not guarantee complete remediation of the infection.

Systems with try-lock-runner version 3.2.1 installed are considered fully compromised, potentially allowing attackers full control over the affected computer. This compromises all secrets and keys stored on the system, necessitating immediate rotation of credentials from a secure environment. The presence of malicious code means that attackers may have persistent access beyond just the package itself.

Remove the try-lock-runner package version 3.2.1 immediately. Rotate all secrets and keys stored on the compromised system from a different, secure computer. Because full control of the system may have been given to attackers, consider rebuilding or thoroughly cleaning the affected system to ensure complete removal of malicious software.