A third-party toolkit downloaded millions of times has spread the flaw to thousands of devices.

The company’s crowdfunding page was hacked during a token sale event to redirect payments to the bad guys.

The council said that the blunder took place on June 15 2017