🎯 TLS certificate validation bypass

The items that name it 5

• Rust Supply-Chain Attack: arrayref, internment, and append-only-vec Poisoned by the proc-macro1 Build-Time Dropper
  writeup2026-08-22

  Custom AcceptAll ServerCertVerifier that unconditionally accepts any certificate, allowing HTTPS connections to a bare IP payload host

• Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns
  writeup2026-08-20

  Disables TLS certificate validation via a custom AcceptAll verifier.

• StubMaker RubyGems Campaign Delivers a Windows Infostealer
  writeup2026-08-16

  HTTPS implementation retries with certificate verification disabled after an SSL failure

• Socket: 141 Mastra npm Packages Compromised via Typosquatted Dependency
  writeup2026-06-20

  both loader and stage-2 implant set NODE_TLS_REJECT_UNAUTHORIZED=0 to allow C2 communication over self-signed/untrusted certificates

• A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope
  writeup2026-06-16

  setup.cjs sets NODE_TLS_REJECT_UNAUTHORIZED='0' so an HTTPS fetch succeeds against a self-signed certificate on a raw IP