The vulnerability in hexpm hex arises because the Hex.RemoteConverger.verify_resolved/2 function fails to verify dependency checksums properly. This occurs because the lock data uses string-based dependency names, while the verification compares atom-based names, resulting in the verification code path being skipped. Although initial package downloads validate checksums, mismatches between the lockfile and resolved dependencies are not detected, enabling integrity bypass. An attacker able to manipulate cached packages or a compromised registry can supply altered dependency contents that are accepted without detection, and the mix.lock file is silently rewritten with these attacker-supplied checksum values.

An attacker with the ability to influence cached packages or a compromised package registry can bypass dependency integrity checks, potentially causing the build system to accept and use tampered dependencies without detection. This undermines the trustworthiness of builds relying on hexpm hex, potentially leading to the execution of malicious code or compromised software supply chains. The silent rewriting of the mix.lock file removes evidence of tampering, complicating detection and forensic analysis.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when using cached packages or registries that might be untrusted or compromised. Avoid using untrusted package sources and consider validating dependencies through alternative means if possible.