The npm package try-lock-runner version 3.2.1 contains malicious code or depends on a malicious package. Any system with this package installed should be considered fully compromised, and all secrets and keys stored on that system should be rotated immediately from a different device. Removing the package alone may not eliminate all malicious software resulting from its installation.