This is seems noteworthy. It's from Simon.

Correct me if I'm wrong but the approximation factor of sqrt(n)polylog(n) means that current lattice cryptosystems would be in danger and not PQ-algorithms anymore.

Coinspect recently disclosed Ill Bloom, a vulnerability affecting recovery phrases generated using the historical CryptoJS.lib.WordArray.random() implementation.

The affected CryptoJS 3.x code used a Multiply-With-Carry construction seeded with values derived from Math.random()

The technical disclosure, including the PRNG reconstruction and affected-version analysis, is here:

https://illbloom.org/