mport index decompression can leave partial or corrupt index data after zstd failures

mport package bundle downloads allow unsafe destination filenames

mport bootstrap index fetch can continue after hash verification failure

mport permits repository and package mirror fetches over insecure transport

mport sample file handling can write outside the configured root

mport package installation can overwrite existing unmanaged or differently owned files

mport package installation has symlink TOCTOU in chown and chmod handling

mport directory asset installation is vulnerable to symlink and path traversal races

mport package fetch and clean paths are vulnerable to TOCTOU filesystem races

mport trusts environment-controlled temporary directories in privileged metadata extraction

mport mirror-selection ping accepts insufficiently validated ICMP replies

mport verify can compare stale checksum data after hashing failures

mport audit can inspect the wrong package when options are present