: boolean } = {}) { // [...Do some custom logic...] // At some point make a request, using the optional verification option: return https.get(url, { rejectUnauthorized: options.verifyCertificates }); } // Later usage looks like it's making a secure HTTPS request, but in fact the certificate // is not being verified at all, so you could be talking to *anybody*: makeRequest("https://google.com"); Be on the path between a vulnerable client and an HTTPS server they want to talk to (for an ISP or proxy this is always true, for local networks this is reliably achievable using various techniques like ARP spoofing opens in a new tab or evil twin wifi opens in a new tab ) That's in line with many very similar vulnerabilities in the past - for example in npm modulesopens in a new tab, Ruby…