What problem does it solve?
Updating Elixir/Hex dependencies can silently introduce supply-chain attacks, typosquatted packages, new CVEs, or maintainer takeovers, and standard tools only report current-state vulnerabilities without showing what an update actually changed.
Core Features & Use Cases
- 8-rule heuristic scan: Detects bidi Unicode control characters, dynamic code evaluation, compile-time shell commands, unsafe binary deserialization, new git/path dependencies, maintainer changes, suspicious base64 blobs, and typosquatting against the top-500 package list.
- Differential CVE analysis: Runs mix_audit against both old and new mix.lock states to report which CVEs were patched, introduced, or remain exposed by an update.
- External tool integration: Wraps mix hex.audit, mix_audit, and OSV-Scanner with rate-limited Hex API enrichment, emitting markdown tables, JSON, or SARIF for CI gating.
- Use Case: After running mix deps.update on a Phoenix project, invoke the audit to get a per-package risk table with rule citations and a security changelog before merging the lock change.
Quick Start
Ask the assistant to audit the current Hex dependency changes with phx-deps-audit before committing the updated mix.lock.
