extuno
Composer packages, checked on every release.
A poisoned Composer release can run code from a composer.json install hook, before any class is required. Extuno diffs each version and reads the PHP for install-script RCE, backdoors, and webshells - with static and AI analysis on every scan.
composer package
Every finding is backed by evidence.
Each finding names the change, why it is dangerous, and the recommended action.
Install-script RCE
A composer.json post-install hook runs curl|bash on `composer install`.
Injected webshell
A file gains eval() over request data - a remote-controlled shell.
Remote code loader
The package fetches a URL and eval()s the response.
Install-time PHP, caught before composer runs it
Extuno reads the composer.json hooks and the PHP, and flags the download-and-run install command.
- + Vulnerability and secret-leak testing on every version
- + Static analysis reads the package without running it
- + AI code analysis reads the full source and correlates the change against prior versions
Scan your first Composer package free.
Your first 5 credits are free - that is 5 full scans, no card required.
Common questions
Does Extuno support Composer?
Yes. Extuno scans Composer with static analysis, and AI code analysis, and diffs every version to catch one that was clean but poisoned through an update.
How does Extuno scan Composer?
Extuno acquires the published Composer artifact, reads it statically with 1100+ rules, reviews the source with AI, and diffs it against the prior version - naming the file, the change, why it is dangerous, and the fix.
What does Extuno catch in Composer?
Leaked secrets, obfuscated or malicious code, dangerous permissions and APIs, exfiltration and command-and-control behavior, and the headline signal: a version that turns malicious after an update.
