Malicious code in kendo-angular-window (npm)

The kendo-angular-window package version 19.10.13 includes malicious code or depends on a malicious package, leading to full compromise of any computer running it. The malicious code presence was identified by Amazon Inspector and reported in the GHSA malware database. Due to the severity, systems with this package installed are at high risk, and remediation requires key rotation and removal of the package, although complete cleanup cannot be guaranteed.

Systems with kendo-angular-window version 19.10.13 installed are considered fully compromised, potentially allowing attackers full control. All secrets and keys stored on the affected system are at risk and must be rotated immediately. The presence of malicious code may enable unauthorized access, data theft, or further malware installation.

Remove the kendo-angular-window package version 19.10.13 immediately. Rotate all secrets and keys stored on the affected system from a different, secure computer. Due to the potential full compromise, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious components.