The vulnerability stems from the insecure HTTP URL defined in the 'buildTools' object within src/constants.js. While no explicit download function is shown in the provided commit diff, this configuration value is directly used to fetch the executable. The commit fixes the issue by changing the protocol to HTTPS, confirming this configuration as the root cause. The lack of encryption in the URL definition makes any code using this value inherently vulnerable, even if the actual download function isn't explicitly shown in the provided snippets.