Insufficiently Protected Credentials

Summary

The tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. In versions prior to 1.1.7, a private key can be extracted on signing a malicious JSON-stringifiable object, when the global Buffer is the buffer package. This affects only environments where `require('buffer')` is the NPM buffer package. The `Buffer.isBuffer` check can be bypassed, resulting in `k` reuse for different messages, leading to private key extraction over a single invalid message (and a second one for which any message/signature could be taken, e.g. previously known valid one). This has the same fix as CVE-2024-49365.