Package registryComposer

Extuno scans the composer.json hook before composer install runs it.

A composer.json install hook fires before your autoloader ever touches the package. Extuno diffs each version, then runs static and AI analysis on the PHP for install-script RCE, backdoors, and webshells.

In shortTo check a Composer package for supply-chain risk, scan the published artifact, not just the source, and compare each new version against the last. Extuno runs static analysis, a dynamic sandbox, and AI review across every Composer release, then reports evidence on every finding.

Scan a Composer package See an example

Composer - live inspectionexample

acme/logger 3.10
composer package

3.9->3.10

Static

Dynamic

Analyzing update

What Extuno catches in Composer

Every finding is backed by evidence.

Each finding names the change, why it is dangerous, and the recommended action.

Diff finding

Install-script RCE

A composer.json post-install hook runs curl|bash on `composer install`.

Critical

Diff finding

Injected webshell

A file gains eval() over request data. That is a remote-controlled shell.

Critical

Diff finding

Remote code loader

The package fetches a URL and eval()s the response.

Review

See it on a poisoned update

Install-time PHP, caught before composer runs it

Extuno reads the composer.json hooks and the PHP, and flags the download-and-run install command.

+ Vulnerability and secret-leak testing on every version
+ Static analysis reads the package without running it
+ AI code analysis reads the full source and correlates the change against prior versions

How it works

your-app

acme/logger 3.10

acme/http-client 7.9

symfony/console 7.1

acme/logger-helper 1.2.1post-install-cmd

acme/logger-helperpackagist-cdn.co

Scan your first Composer package free.

5 free credits on signup. One credit per scan, no card required.

Try Free Talk to sales

FAQ

Common questions

Does Extuno support Composer?

Yes. Extuno scans Composer with static analysis, and AI code analysis, and diffs every version to catch one that was clean but poisoned through an update.

How does Extuno scan Composer?

Extuno acquires the published Composer artifact, reads it statically with 1100+ rules, reviews the source with AI, and diffs it against the prior version. The finding names the file, the change, why it is dangerous, and the fix.

What does Extuno catch in Composer?

Leaked secrets, obfuscated or malicious code, dangerous permissions and APIs, exfiltration and command-and-control behavior, and the headline signal: a version that turns malicious after an update.