Use global.location.host over '*' in global.postMessage
Use global.location.host over '*' in global.postMessage

This addresses a security concern where messages can be intercepted and/or sent to
any window that uses '*' as the 2nd parameter (the origin) to postMessage.

zloirock/core-js,zloirock/core-js