Description

Detects Elixir projects that have declared Hex dependencies in mix.exs but are missing the mix.lock file. Missing lock files can lead to supply chain vulnerabilities since dependency versions aren't explicitly pinned, potentially allowing malicious package versions to be installed.

Detection Strategy

• Checks if the file contains Hex dependency declarations (tuples starting with '{:') indicating Elixir dependencies

• Verifies if 'mix.lock' exists in the same directory as the mix.exs file

• Reports a vulnerability if Hex dependencies are declared but no lock file is present