snyk critical vulnerability warning of elliptic 6.6.0 and 6.6.1

[hui-an-yang]

Hello elliptic team

We received critical vulnerability warning from snyk of latest elliptic that at worse a private key exposure is possible
Wondering if the team is aware of the issue and have a plan/eta of the fix
Side note: weirdly i tried looked up _truncateToN mentioned in the screenshot but doesn't seem to be in your codebase might be your dependencies

[opepin]

I think that's related to https://security.snyk.io/vuln/SNYK-JS-ELLIPTIC-8187303
#322 (comment)

[bleichenbacher-daniel]

I think that's related to https://security.snyk.io/vuln/SNYK-JS-ELLIPTIC-8187303 #322 (comment)

Yes, that is the issue that Snyk is flagging. This issue is now open for a year. It kind of looks like the library has been abandoned or that at least fixes are very slow. One effect of slow fixing is that other tools (e.g. npm audit #321 (comment)) do not report the problem.

[cmoreira-handtevy]

+1