Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
FollowingThe React team released a patch on December 3rd, recommending that all users of react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack upgrade to the latest version immediately.
According to the cybersecurity non-profit organization SEAL, there has been an increase in incidents where cryptocurrency theft malware is uploaded to websites, due to a vulnerability in the open-source JavaScript library React.
React is used to build user interfaces, especially in web applications. On December 3rd, the React team revealed that white-haired hacker Lachlan Davidson discovered a security flaw in their software. This flaw allows unauthenticated remote code execution, enabling attackers to insert and run their own code.
According to SEAL, criminals have been using the CVE-2025-55182 vulnerability to secretly add code that steals wallet funds from legitimate cryptocurrency websites.
“We have observed a significant increase in the number of malicious programs that exploit the recent React CVE vulnerability and are uploaded to legitimate cryptocurrency websites. All websites should now review their front-end code for any suspicious activities,” said the SEAL team.
“The targets of these attacks are not limited to Web3 protocols! All websites are at risk. Users should be extremely cautious when signing any licensing agreements.”
Wallet thieves often use fake pop-ups to offer rewards or other tactics to trick users into signing transactions.
Source: Security Alliance
Websites that display phishing warnings should review their code for issues with
. According to the SEAL team, affected websites may be marked as phishing sites without any explanation. They recommend that website hosts take preventive measures to ensure there are no hidden vulnerabilities that could pose a threat to user safety.
“Check whether the host has the CVE-2025-55182 vulnerability. Verify that your front-end code does not load resources from hosts that you cannot identify. Check if there is any obfuscated JavaScript code in the scripts loaded by your front-end code. Also, verify that the recipient information displayed in the signature request is correct,” they said.
“If your project is blocked, this might be the reason. Please review your code first, and then apply for removal of the phishing warning,” added the SEAL team.
React has released a fix for this vulnerability
. The React team released a fix for CVE-2025-55182 on December 3rd, and advised all users who use react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack to update immediately to fix the vulnerability.
“If your application’s React code does not use servers, then your application is not affected by this vulnerability. If your application does not use frameworks, packagers, or plugins that support React server components, then your application is also not affected by this vulnerability,” the team noted.
