extuno
How Extuno analyzes an extension or package
Every scan runs the same pipeline: acquire the published artifact, unpack it, analyze it three ways, diff it against the previous version, then score and band the result. This page walks through each stage and what it produces.
How does Extuno acquire and unpack the package?
A scan starts from the published artifact, not from code you upload. Extuno fetches the live package for the target ecosystem - one of eight: Chrome, Firefox, VS Code, JetBrains, Eclipse, Discord client mods, npm, PyPI, WordPress, Composer, and Maven - by its store or registry id. This means the bytes Extuno analyzes are the exact bytes a user or build server would install.
The artifact is then unpacked into a file tree: manifest, source files, assets, and bundled dependencies. The unpacked tree is what every later stage reads. Acquisition records the version string and content hash so the same version is never re-analyzed twice and so the next stage has a baseline to diff against.
What does static analysis do?
Static analysis reads the unpacked code without running it. More than 1100 rules look for malicious behavior, dangerous permission combinations, and obfuscation, and over 1000 secret detectors find leaked API keys, tokens, and credentials shipped inside the package.
Because nothing executes, this stage is fast and safe to run on every file, including install scripts and config. It is also the layer that powers CI/CD secret scanning and the pass/fail gate. See static analysis for the rule families and detection rules for the full catalog.
Why run the package in a sandbox?
Static reading cannot see code that only assembles or decodes itself at runtime. The dynamic sandbox runs the extension or package in an isolated, network-segmented microVM and records what it actually does: the network endpoints it contacts, the data it sends to each one, the API calls it makes, and screenshots of any UI.
The microVM is disposable and segmented, so live malware can be observed without risk to the host or other tenants. Runtime evidence, such as a credential leaving in a request body, confirms behavior that static rules can only suspect.
What does the AI review add?
AI code analysis reads the full source, correlates behavior across files and versions, and explains why a finding is dangerous in plain terms. It is advisory: it adds context and can surface obfuscated logic, but it never overrides the verdict produced by the deterministic layers.
This keeps the scoring stable and reproducible while still giving an analyst a readable account of what the code is trying to do. The AI output is attached to findings as explanation, not as a separate score input.
How does version-diffing catch supply-chain attacks?
The headline differentiator is version-diffing. Extuno compares the new version against the previous one and flags a benign-to-dangerous escalation: a new exfiltration endpoint, a permission that was just added, freshly introduced obfuscation, or a band change from clean to flagged.
This is how Extuno catches an extension or package that was legitimate at review time and then poisoned through its update channel. A first scan establishes the baseline; continuous monitoring re-scans only when the published version actually changes, so an update that turns malicious is caught on the same day.
How are findings scored and reported?
Each rule carries a severity and weight. Risk scoring combines the layers into a numeric score and a band from clean through critical, weighted so that a confirmed runtime theft outranks a single static signal. Popular, well-established packages are not auto-flagged on capability alone.
The output is evidence-based: every finding names the file, the line, why it is dangerous, and the recommended action. The same result is available as a human report, as machine-readable SARIF and JSON, and as a pass/fail gate for builds. See a full sample report.
{
"rule": "diff.behavior.new_exfil_endpoint",
"severity": "critical",
"category": "supply-chain",
"file": "background.js",
"line": 412,
"from_version": "3.2.1",
"to_version": "3.3.0",
"why": "New POST to an external host carrying cookie data; absent in 3.2.1",
"action": "Block the update and review the publisher account"
}Frequently asked questions
Does Extuno analyze the code I write or the published package?
It analyzes the published artifact, fetched by its store or registry id. The bytes scanned are the exact bytes a user or build server would install, so the result reflects what is actually shipping rather than a local working copy.
Why run all three layers instead of just static analysis?
Each layer sees something the others cannot. Static analysis reads every file fast and safely, the microVM sandbox observes runtime behavior that only appears when code executes, and the AI review explains and correlates findings across versions. Together they confirm behavior rather than only suspecting it.
Is it safe to run malicious code in the sandbox?
Yes. Dynamic analysis runs in an isolated, network-segmented, disposable microVM. Live malware can contact its endpoints and reveal what data it sends without any access to the host, the database, or other tenants.
How does the version-diff stage know what changed?
Acquisition records the version and content hash on every scan, so Extuno has a stored baseline. The diff stage compares the new version's behavior, permissions, and findings against the previous version and flags any escalation from benign to dangerous.
What do I actually get at the end of a scan?
An evidence-based report where every finding lists the file, line, reason, and recommended action, plus a risk score and band. The same result is exportable as SARIF and JSON and as a pass/fail gate for CI/CD pipelines.