New React bug that can drain all your tokens is impacting ‘thousands of’ websites