is-arrayish was compromised to include malicious code that targets browser-based web3 environments. The injected payload intercepts Ethereum and Solana wallet interactions, redirecting funds and approvals to attacker-controlled addresses. The compromise occurred after a maintainer’s account was accessed via phishing. At the moment, there is no fix version. We recommend removing the affected version from the codebase and downgrading to the last clean version 0.3.2