fix: fix security issue in argentinacdp.js

[anupamme]

Summary

Fix high severity security issue in argentinacdp.js.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	argentinacdp.js:4
Assessment	Likely exploitable

Description: The application dynamically fetches its API base URL from an external GitHub raw content endpoint without integrity verification, certificate pinning, or allowlist validation. While HTTPS is used, an attacker with a man-in-the-middle position (compromised router, DNS hijacking, corporate proxy, or compromised CA) could intercept and modify the response to return a malicious API URL, redirecting all subsequent API traffic to an attacker-controlled server.

Evidence

Exploitation scenario: An attacker with network-level access (ARP spoofing, compromised router, DNS hijacking, or rogue CA certificate) intercepts the HTTPS request to raw.githubusercontent.com and returns a malicious.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Changes

• argentinacdp.js

Behavior Preservation

The change is scoped to 1 file on the vulnerable path.

---

Automated security fix by OrbisAI Security