electron-builder

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The documentation shows auto-update/publish providers that the running app will contact at runtime (for example the Generic provider url "https://example.com/releases" and the custom updater url "https://example.com/auto-updates", as well as GitHub/S3 endpoints) to fetch update metadata and installer artifacts which can be downloaded and executed on the client, so these URLs are runtime external dependencies that can result in executing remote code.