Vendor
The @rsdoctor/rspack-plugin binds its report server to all network interfaces with no authentication, allowing attackers to exfiltrate source code and build metadata via an unauthenticated POST request.