Hex's RemoteConverger module skips checksum verification for dependencies written in mix.lock because the lock data is returned as string names while the verification logic expects atom names. As a result, the verification code path is silently omitted and the checksum checks are never performed. An attacker who can supply altered package content—either through a compromised registry or by poisoning the local cache—can provide malicious dependencies that will be accepted without detection. The mix.lock file is rewritten with checksum values from the registry, erasing evidence of tampering. This flaw allows an attacker to bypass dependency integrity checks and alter the code that is delivered to a build, effectively compromising the supply chain.

hexpm's Hex package manager (hex) from version 0.16.0 up to, but not including, 2.4.2 is vulnerable. Any project that uses these versions of Hex to resolve dependencies and build reproducibility is at risk. This includes Erlang/OTP projects and any language ecosystem that relies on Hex for dependency management.

The CVSS score of 8.9 signals high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector—local cache poisoning or a compromised registry—means that exploitation requires influence over the registry or local package cache, an attack scenario that is plausible in controlled environments or supply-chain contexts. Because the checksum verification is bypassed, a successful attack could lead to arbitrary code execution or other supply‑chain compromise. The risk is therefore significant, and the vulnerability should be treated as high‑priority.