CVE-2021-21373

Nimble is a package manager for the Nim programming language. In Nim
release versions before versions 1.2.10 and 1.4.4, “nimble refresh” fetches
a list of Nimble packages over HTTPS by default. In case of error it falls
back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An
attacker able to perform MitM can deliver a modified package list
containing malicious software packages. If the packages are installed and
used the attack escalates to untrusted code execution.