feat(tools): Hex.pm enrichment in get_dependency_blast_radius

[manus-use]

Summary

Adds _enrich_hex to get_dependency_blast_radius.py, bringing Elixir/Erlang package ecosystem support via the Hex.pm public API.

What changed

src/manus_agent/tools/get_dependency_blast_radius.py

• _parse_hex_timestamp(ts) — new helper to parse Hex.pm ISO-8601 timestamps (handles Z suffix, +HH:MM offset, variable sub-second precision). Returns (iso_date, age_years).
• _enrich_hex(name) — new enricher that makes a single GET https://hex.pm/api/packages/{name} call and extracts:
  • weekly_downloads (from downloads.week) — feeds directly into _blast_score
  • total_downloads (from downloads.all)
  • recent_downloads (from downloads.recent — last 90 days)
  • latest_version (latest_stable_version preferred, latest_version as fallback)
  • total_versions (length of releases list)
  • first_release_date + age_years (from releases[-1].inserted_at)
  • description (from meta.description, truncated to 120 chars, newlines stripped)
  • home_page (from html_url)
• _enrich_package dispatch extended: hex, elixir, erlang ecosystem strings all route to _enrich_hex.
• Hex output block in the main loop renders: Latest version, Total versions, Total downloads, 90-day downloads, First released + age, Description, Hex page URL.
• _ECOSYSTEM_LABEL already had "Hex": "Hex (Elixir/Erlang)" — no change needed.
• Docstring updated: lists Hex.pm as data source Feat: Virtualized Environment Exploit Automation  #7; adds hex: / elixir: to supported ecosystem prefixes; documents new exposure metric row.

tests/test_dependency_blast_radius.py

25 new tests across two new classes:

Class	Count	What it tests
TestParseHexTimestamp	7	Z suffix, no microseconds, 6-digit microseconds, +00:00 offset, None input, empty string, invalid string
TestEnrichHex	15	Basic fields, download stats, first-release date, description truncation + newline stripping, home_page, graceful degradation on network error, missing downloads key, missing/empty releases, CRITICAL blast score, MEDIUM blast score, latest_stable_version preference, fallback to latest_version, package name preservation
TestEnrichPackageDispatch	3	hex, elixir, erlang all dispatch to _enrich_hex

Suite: 74 → 99 tests in this file; 1183 total (all passing).

Why Hex.pm

Hex.pm is the package manager for the Erlang ecosystem (Elixir, Erlang, Phoenix, Ecto, Plug). Several CVEs affect widely-downloaded Hex packages:

• CVE-2022-24804 — plug_crypto (a Phoenix dependency with >300M all-time downloads)
• CVE-2020-5258 — nerves_network

The Hex.pm API is free, unauthenticated, and well-documented. A single request returns everything needed — no pagination, no second call.

API details

GET https://hex.pm/api/packages/{name}

Response fields used:

• downloads.week — 7-day download count (blast score input)
• downloads.all — all-time total
• downloads.recent — last 90 days
• latest_stable_version — current non-pre-release
• releases[].inserted_at — per-version publish timestamp
• meta.description — one-line summary
• html_url — https://hex.pm/packages/{name}

No authentication required. No rate-limit concerns for single-package lookups.

Checked against existing open PRs — no overlap

Reviewed all 33 open PRs before building. None covers Hex.pm enrichment:

#51 (silent-patches), #53 (cve-timeline), #54 (version-range), #58 (vendor-response), #60 (poc-freshness), #64 (sbom-scan), #65 (temporal-priority), #67 (cluster-variants), #74 (epss-decay), #75 (exploit-maturity), #76 (vulnerability-triage), #77 (cve-report), #78 (diff-report), #79 (reachability), #80 (epss-watchlist), #82 (attack-surface), #83 (watch-alert), #85 (cli-integration-tests), #86 (patch-lag), #87 (kev-context), #88 (readme-scoring-workflow), #89 (core-tools-tests), #90 (exploit-search-tests), #96 (maven-first-release-date), #97 (osv-data — already merged), #98 (pypi-first-release-date), #100 (npm-first-release-date), #103 (enrich-crates), #104 (enrich-rubygems), #105 (enrich-nuget), #106 (enrich-go), #107 (enrich-packagist)