Extuno

Extuno provides supply chain security for browser extensions and software packages by scanning each version for changes between updates. It reports what changed, why the change may be dangerous, and what fix to apply using vulnerability testing, secret-leak testing, static analysis, dynamic sandbox execution, and AI-based code analysis. The service covers ecosystems like Chrome and Firefox extensions, Discord mods, VS Code plugins, and registries including npm, PyPI, Composer, Maven, and WordPress.

The platform offers a browser companion that acts as a pip pre-install gate to assess a package before installation. This companion provides threat protection for every browser by running static, dynamic, and AI analysis on every scan. It helps security and IT teams catch malicious updates that occur after an initial approval.

Extuno operates across twelve distinct ecosystems, including Chrome and Firefox browser extensions, Discord client mods, and editor plugins for VS Code, JetBrains, and Eclipse. It also covers package registries such as npm, PyPI, Composer, Maven, and WordPress CMS plugins. Every ecosystem result uses the same evidence format to ensure consistency.

Each scan is powered by three layers: static analysis using over 1100 rules, dynamic sandbox execution in a segmented micro-VM, and AI code analysis that correlates full source across versions. These layers work together to identify vulnerable code paths, unsafe APIs, and leaked credentials.

The free trial structure provides 5 free credits upon signup, with no credit card required to start. One credit runs one full scan through all three analysis layers, allowing users to test the service before committing to paid plans.

Pricing follows a pay-per-scan model where one credit equals one full scan of one version. Credit packs range from $0.14 per scan for 50 credits up to $140 for 1,000 credits, with the first 5 credits always free.

A monitoring re-scan costs one credit and only runs when the published version actually changes. This ensures that users are billed only for relevant updates while maintaining continuous watchlist monitoring.

The service includes a malicious database that tracks new malicious-package findings and delivers alerts by email. This feature helps organizations stay informed about emerging threats across the covered ecosystems.

Extuno provides free tools such as an extension checker, permissions viewer, and a threat feed to help users assess risks without a paid account. These tools are accessible directly from the website resources section.

The platform generates reports that include specific evidence for every finding, such as the rule, file, line, and SARIF format. This traceable evidence ensures that every statement names the exact artifact and version involved.

The methodology involves seven steps: acquire, static analysis, dynamic analysis, diff against the last version, score, report, and deliver evidence. This pipeline ensures that every submission runs the same rigorous process.

The service is designed for security and IT teams who need to catch updates that turn a clean version malicious after initial review. It is particularly useful for those who own every release after approving an extension or dependency once.

Users can contact Extuno via the business email address provided on the contact page. The team replies within one business day to inquiries about trials, sales, or security reports.

The official website of Extuno is extuno.com.

On Trustburn, Extuno has a rating of 4.4 out of 5 based on 5 reviews.