A newly reported React vulnerability is being exploited to install malware and crypto-miners, risking token theft and potential wallet interception on thousands of sites.