Security Alliance (SEAL), a cybersecurity nonprofit, reports a surge in attacks exploiting a security flaw in the open-source JavaScript library React. Hackers are using this vulnerability to implant crypto drainer programs on websites. On December 3, the React team disclosed that white-hat hacker Lachlan Davidson identified a flaw allowing attackers to execute code remotely without authentication, enabling the insertion of malicious code. SEAL warns that this threat extends beyond Web3 projects, potentially affecting all websites, and advises users to exercise caution when signing any permit authorizations.