The npm package 'root-locator' versions 1.1.0 and 1.2.0 contain malicious code or depend on code that is malicious. Installing or running this package can lead to a full compromise of the affected computer. Secrets and keys stored on the compromised system should be rotated immediately from a different, secure machine. Removing the package alone may not eliminate all malicious software introduced by it.