gitlab/npm/hubl-server/CVE-2017-16035
Cleartext Transmission of Sensitive Information
During installation hubl-server downloads a set of dependencies from `api.hubapi.com.` It appears in the code that these files are downloaded over HTTPS however the `api.hubapi.com` endpoint redirects to an HTTP url. Because of this behavior an attacker with the ability to man-in-the-middle a developer or system performing a package installation could compromise the integrity of the installation.