hoplon v0.3.2 mix hoplon.check View Source

Checks the project’s dependencies for hidden code.

Running this task will go through the project’s dependencies, resolve where they’re located on GitHub, clone each of their repos, check out the commit corresponding to the package version and screen the packages for any code differing from what is in the git repository.

The idea is that while the GitHub repositories are constantly screened by the BEAM community, the published packages are rarely examined and it takes just one malicious maintainer to do a lot of damage.

Running $ mix hoplon.check lets you screen for this form of attack.

If hoplon finds suspicious differences in the code or fails to resolve the repository, the task will exit with a non-zero code.

Link to this section Summary

Functions

Runs the task

Link to this section Functions