extuno
Dynamic microVM sandbox for extensions and packages
Static analysis reads the code; the dynamic sandbox runs it. Extuno executes the real extension or package inside an isolated, network-segmented microVM and captures what it actually does at runtime.
What does the dynamic sandbox actually do?
The sandbox runs the real artifact in a disposable microVM and watches its behavior instead of guessing from source. Each run records four things: every network endpoint the code contacts, the exact data it sends (including POST payloads), the runtime API calls and DNS lookups, and screenshots of any pages or popups it opens.
This catches code paths that never show up in a code read: a loader that pulls a second-stage payload after install, a collector that ships browsing data to a remote host, or a package install script that phones home. See how it fits the wider pipeline in how it works and the deeper write-up at dynamic sandbox analysis.
Why run code instead of only reading it?
Obfuscated, packed, or remotely fetched logic can hide from a code reader. A string can be assembled at runtime, a domain can be decoded from base64, and a payload can arrive over the network minutes after load. The sandbox sees the result regardless of how the code was disguised, because it observes the actual outbound request.
Dynamic results pair with the rest of the engine: static analysis flags the suspect code, and the sandbox confirms whether it fires. When the two disagree, that gap is itself a signal worth reviewing.
How is the host kept safe from real malware?
The sandbox assumes the artifact is hostile. Each run gets a fresh, throwaway microVM that is destroyed afterward, so nothing persists between runs and nothing reaches the host. The network is segmented and controlled: outbound traffic is observed and recorded, but the run cannot pivot into internal infrastructure.
The environment is built to resist anti-sandbox evasion. Many malicious extensions check for analysis environments and stay quiet when they detect one. Extuno hides the common tells so behavior that only triggers on a real user machine still runs and gets captured.
What does a captured run look like?
A run produces a trace: a time-ordered list of network requests with method, host, and payload; DNS queries; runtime API calls; and screenshots. Each suspicious entry becomes evidence attached to a finding, with the file or origin, the destination, and the recommended action, so the result is reviewable rather than a bare score. See the format on the sample report.
The same trace feeds version diffing: when a later version starts contacting a new endpoint or sending new data, the dynamic delta surfaces a benign-to-dangerous escalation introduced through the update channel.
Which ecosystems run in the sandbox?
Extuno runs all twelve supported ecosystems: Chrome, Firefox, VS Code, JetBrains, Eclipse, Discord client mods, npm, PyPI, WordPress, Composer, and Maven. For packages, the sandbox is especially useful against install-time and import-time code, where a malicious install script or first-import payload executes the moment a developer pulls the dependency.
Read the ecosystem detail for npm and PyPIComposerMaven, or browse confirmed cases in the malicious database. Dynamic results also flow into continuous monitoring so a poisoned update is caught after install, not just before.
[
{ "ts": 2.41, "type": "dns", "host": "collect.example-cdn.net" },
{ "ts": 2.55, "type": "request", "method": "POST",
"host": "collect.example-cdn.net", "path": "/ingest",
"payload": { "cookies": "<captured>", "url": "https://mail.example.com/" } },
{ "ts": 2.61, "type": "api_call", "name": "chrome.cookies.getAll" },
{ "ts": 3.10, "type": "screenshot", "label": "popup.html" }
]Frequently asked questions
Does the sandbox capture HTTPS request bodies?
Yes. The trace records the data the code sends, including POST payloads, not just the destination host. That lets you see exactly what a collector exfiltrates rather than only that a request was made. Each captured payload is attached as evidence to the related finding.
Can malware tell it is running in Extuno's sandbox?
The sandbox is built to handle anti-sandbox evasion. Malicious extensions often probe for analysis environments and stay dormant when they detect one. Extuno conceals the usual indicators so behavior that only fires on a real machine still executes and is recorded.
Is dynamic analysis run on every scan?
Dynamic analysis runs the real artifact in a microVM as part of the standard pipeline, alongside static analysis and AI code analysis. The AI layer is advisory and explains findings but never overrides the verdict, while static and dynamic results carry evidence on every finding.
How does the sandbox help with supply-chain attacks?
When an update is scanned, its sandbox trace is diffed against the prior version. A new outbound endpoint, a new payload, or a new API call appearing in the update flags a benign-to-dangerous escalation, which is the signature of a package or extension poisoned through its update channel.
Is there a cost to dynamic analysis?
Extuno has a free tier plus paid scan-credit packs. Dynamic, static, and AI analysis are part of the same scan. See the breakdown on the pricing page.