Threats affecting pkg:github/karingx/clashmi

KaringX ClashMi versions up to 1.0.32.1801 disable TLS certificate validation by default in the HttpUtils helper. This flaw allows attackers to intercept HTTPS traffic by presenting any certificate. An attacker controlling the user's proxy node can serve a malicious update manifest lacking sha256 verification, leading to execution of a malicious installer during the update process.