extuno
A Maven artifact can run code the moment a class loads.
A Maven JAR ships JVM bytecode, not source. Extuno scans the .class constant pool for process execution, remote class-loading, script engines, and credential access that ends in a network call. Static and AI analysis run on every scan.
maven artifact
Every finding is backed by evidence.
Each finding names the change, why it is dangerous, and the recommended action.
Runtime.exec on load
A static initializer spawns a shell when the class is loaded.
Credential exfiltration
Bytecode reads an env credential and opens a network connection.
Remote class-loading
URLClassLoader.addURL pulls code from a remote URL.
Malicious bytecode, read without running it
Extuno scans the .class constant pool and flags the process-exec and the credential-to-network flow.
- + Vulnerability and secret-leak testing on every version
- + Static analysis reads the package without running it
- + AI code analysis reads the full source and correlates the change against prior versions
Scan your first Maven package free.
5 free credits on signup. One credit per scan, no card required.
Common questions
Does Extuno support Maven?
Yes. Extuno scans Maven with static analysis, and AI code analysis, and diffs every version to catch one that was clean but poisoned through an update.
How does Extuno scan Maven?
Extuno acquires the published Maven artifact, reads it statically with 1100+ rules, reviews the source with AI, and diffs it against the prior version. The finding names the file, the change, why it is dangerous, and the fix.
What does Extuno catch in Maven?
Leaked secrets, obfuscated or malicious code, dangerous permissions and APIs, exfiltration and command-and-control behavior, and the headline signal: a version that turns malicious after an update.