Downloads Resources over HTTP in nodewebkit
Affected versions of `nodewebkit` insecurely download an executable over an unencrypted HTTP connection.In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `nodewebkit`.RecommendationNo patch is currently available, and the package author has deprecated this package.The best path forward in mitigating this vulnerability is to use the [official installer](https://www.npmjs.com/nw) instead of this package, as per the package author's instructions.