The npm package async-lock-queue version 3.0.1 contains malicious code or depends on a package with malicious code. Installing or running this package can lead to a full compromise of the affected system. Secrets and keys stored on the compromised system should be rotated immediately from a different, secure machine. Removing the package alone may not eliminate all malicious software introduced by it.