Static analysis tool for Elixir dependencies. Scans your project's dependency code for supply chain attack indicators — credential theft, code execution, data exfiltration, obfuscation — before they reach production.

Your dependencies run in the same BEAM as your application. A compromised package can call System.get_env("AWS_SECRET_ACCESS_KEY") at compile time, exfiltrate it over HTTP, and you will never see it happen. The Elixir ecosystem trusts its packages, and that trust is largely deserved. But trust does not scale with the number of transitive dependencies in a modern project.

Vet walks the AST of every dependency in your lock file and flags patterns that have no legitimate reason to appear in a library: compile-time system commands, environment variable access for sensitive keys, network calls to suspicious endpoints, obfuscated payloads, and more.

It also addresses a newer problem: LLMs hallucinate package names at a measurable rate. Attackers have begun registering those hallucinated names on package registries with malicious payloads — a technique called "slopsquatting." Vet detects these phantom packages and typosquats before you install them.

Add vet_cli to your project's dependencies:

def deps do
  [
    {:vet_cli, "~> 0.1", only: :dev, runtime: false}
  ]
end

mix vet

This parses your mix.lock, walks the source of every dependency, and reports findings with risk scores. Dependencies are scored from 0 to 100 based on the severity of findings and package metadata.

Options:

• --path, -p — project path (defaults to current directory)
• --format, -f — output format: terminal (default), json, diagnostics
• --threshold, -t — exit with error if any dependency's risk score meets or exceeds this value (default: 50)
• --skip-hex — skip hex.pm metadata checks (useful offline or in CI without network)
• --no-diff — skip automatic version diffing (faster scans, no network fetch of previous versions)
• --verbose, -v — verbose output

mix vet.check

Run this before mix deps.get. It reads your mix.exs directly — no lock file or fetched dependencies required — and checks each declared dependency against hex.pm:

• Does the package exist? (phantom package detection)
• Is the name suspiciously close to a popular package? (typosquat/slopsquat detection)
• Is it recently published with very low adoption? (metadata signals)

If any dependency does not exist on hex.pm, the task exits with an error.

Vet automatically compares each dependency against its previous version on Hex. Hex retains every published version permanently, so this works regardless of what you previously had installed.

If a version transition introduces suspicious patterns (new files outside of tests, increased security findings, or a shift in the package's security profile), Vet flags it as a [VERSION DIFF] finding. These findings bypass the allowlist. The allowlist says "we trust this package's existing behavior." A version diff says "the behavior changed."

This is how Vet catches a compromised update to an allowlisted package. If a trusted dependency pushes a new version that adds compile-time credential theft, the diff against the previous version surfaces it even though the package is allowlisted.

Use --no-diff to disable version diffing for faster offline scans.

Vet runs 10 source-level checks against each dependency's AST:

Every finding distinguishes between compile-time and runtime context. Compile-time findings score significantly higher because they execute during mix deps.compile — before your application code runs.

Source-level scanning has known evasion paths: defdelegate, atom-aliased module names, macro-synthesized calls, .erl files compiled to BEAM, $handle_undefined_function/2, NIFs, and dynamic dispatch. Vet does not pretend these don't exist — instead it stacks six additional inspection layers, each of which catches a different evasion class. An attacker has to defeat all of them, not just AST analysis.

These layers don't replace AST scanning — they augment it. Most malicious patterns surface in source. The seven layers exist to close the doors that source analysis alone leaves open.

No single layer is a silver bullet. Together, they push the cost of a successful supply-chain attack from "spell the call differently" up to "compromise the publisher's signing key, evade the sandbox, and avoid every BEAM-level signal across the entire delta."

Each dependency receives a risk score (0–100) combining code findings and package metadata:

Findings — compile-time critical: +40, compile-time warning: +20, runtime critical: +15, runtime warning: +5, info: +1.

Metadata — non-hex source (git/path): +10, downloads <100: +20, downloads <1000: +10, released in last 7 days: +15, single owner: +5, no description: +5, dependency depth 3-4: +5, depth 5+: +10.

Popularity adjustment — packages with >10M downloads: score ×0.3, >1M: score ×0.5. Widely adopted packages are less likely to be malicious; their findings are typically legitimate framework patterns.

Risk levels — critical (>=80), high (>=50), medium (>=20), low (<20).

Many legitimate libraries trigger findings. Phoenix uses @before_compile, Ecto runs Code.eval_quoted for query compilation, Rustler executes system commands to build native code. Vet ships with a built-in allowlist covering the Phoenix 1.7+ ecosystem and common Elixir packages (~100 suppression rules).

You can extend it with a .vet.exs file in your project root:

%{
  allow: [
    {:my_package, :system_exec, "Runs native build toolchain"},
    {:another_package, :network_access, "Fetches remote config at compile time"}
  ]
}

Vet ships with an AGENTS.md that tells AI coding assistants how to use its functions. If your project uses Tidewave, agents can call Vet's functions through project_eval with zero configuration.

The key function for agents:

VetCore.PreInstallCheck.check_package(:some_package)

This checks whether a package exists on hex.pm, detects typosquats and slopsquatting targets, and returns metadata signals — all before the package is installed. An AI assistant that calls this before suggesting a dependency can intercept slopsquatting at the point of recommendation rather than after installation.

Other functions available through project_eval:

• VetCore.scan(path) — full project scan with risk scores and findings
• VetCore.VersionDiff.diff(path, :pkg, "1.0.0", "1.1.0") — compare package versions for suspicious changes
• VetCore.PreInstallCheck.check_deps(path) — check all mix.exs dependencies at once

See AGENTS.md for complete usage.

Vet is structured as an umbrella project:

• vet_core — scanner, checks, AST walker, scoring, metadata fetching, typosquat detection
• vet_cli — Mix tasks (mix vet, mix vet.check)
• vet_reporter — output formatting (terminal, JSON, diagnostics)
• vet_service — persistence layer for scan history and community attestations

• Vet reduces risk. It does not eliminate it. A clean scan is not proof of safety. Do not use Vet as the sole basis for trusting a dependency.
• Elixir/Erlang only. Does not scan npm, Python, or other ecosystems.
• Native code is opaque. Layer 5 detects the presence of NIFs and native build systems but cannot analyze the machine code they ship. A NIF that exfiltrates secrets is invisible to every layer except presence detection.
• Layer 4 needs a baseline. The delta check requires a cached prior profile in .vet/beam_profiles/. The first scan of a new dependency has nothing to diff against — the second scan is when delta findings become useful.
• Layer 6 is opt-in for the ecosystem. Most Hex packages are not signed. Attestation is most valuable for inner-source / vendored / private-registry packages where you control the signing.
• Layer 2 is opt-in. The sandbox is gated behind sandboxed_compile: true because running every dep's compile inside sandbox-exec / bwrap materially slows scans and depends on the host OS shipping the right tool.
• Layer 7 detects undeclared capabilities, not malicious ones. A package can declare [:network, :system_exec, :code_eval] and Vet will not flag it — the value is in the surprise. Diff against the prior declaration to spot expanding scope.
• Static analysis. Cannot detect malicious behavior hidden behind runtime conditionals, encrypted payloads decrypted at a later stage, or code loaded dynamically from external sources beyond what Layer 4's delta surfaces.
• The typosquat corpus is a static list of ~200 popular packages. Packages outside this list will not trigger proximity checks.
• Metadata checks require network access to hex.pm. Use --skip-hex when running offline.
• Vet trusts hex.pm API responses. If hex.pm itself is compromised, metadata-based checks become unreliable.

See SECURITY.md for Vet's own attack surface and trust boundaries.

MIT